In Splunk SOAR versions prior to 8.6.0, the application builds SQL queries for custom list retrieval using user-supplied list names without binding these inputs as parameters. This improper handling leads to SQL injection, enabling users with the 'Automation Engineer' role to execute arbitrary SQL statements against the database. The vulnerability affects the integrity and confidentiality of data stored in the Splunk SOAR database.

An attacker with the 'Automation Engineer' role can perform unauthorized create, read, update, and delete operations on the Splunk SOAR database. This compromises data confidentiality and integrity but does not affect availability. The CVSS score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the 'Automation Engineer' role to trusted users only and avoid using custom lists in playbooks with untrusted input. Monitor Splunk SOAR vendor communications for updates on patches or official mitigations.