Threat Intelligence Database

In Splunk SOAR versions below 8.6.0, users with the OnPrem Broker role can write files outside the intended Automation Broker log directory due to insufficient validation of filenames during log uploads. This vulnerability allows limited unauthorized file write capabilities but does not impact confidentiality or availability. The issue is identified as CWE-22 (Path Traversal).

Splunk SOAR versions below 8.6.0 contain a vulnerability where an authenticated user with restricted tenant access can use the REST API to view tenant names and identifiers outside their role scope. This occurs because role-based tenant restrictions are not enforced properly in multi-tenant deployments when returning tenant information via the REST API.

Splunk SOAR versions below 8.6.0 contain a stored Cross-Site Scripting (XSS) vulnerability that allows a user with the "Incident Commander" role to store JavaScript in a note. This script can execute in the browser of another user when they open the note. The vulnerability arises because note content is treated as HTML without proper sanitization when the note format changes. Exploitation requires tricking the victim into initiating a request in their browser. The vulnerability has a moderate severity score and no known exploits in the wild.

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing for create, read, update, and delete operations on all relevant data stored in the Splunk SOAR database. The SQL injection is possible because Splunk SOAR builds the custom list database lookup with the supplied list name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and Create custom lists for use in Splunk SOAR playbook comparisons (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/create-custom-lists-for-use-in-splunk-soar-cloud-playbook-comparisons) in the Splunk documentation.

CVE-2026-76362 affects Splunk SOAR versions below 8.6.0. The vulnerability arises because the CyberArk REST client integrated with Splunk SOAR does not validate server certificates by default. An unauthenticated attacker with network interception capabilities between Splunk SOAR and the CyberArk REST server could access or modify sensitive data exchanged through the credential manager. This flaw requires the attacker to be able to observe or alter network traffic. The vulnerability has a high severity rating with a CVSS score of 7.4.

CVE-2026-76361 is a Server-Side Request Forgery (SSRF) vulnerability in Splunk SOAR versions prior to 8.6.0. An administrator user can exploit the /rest/support/connectivity/.../check_connectivity endpoint to make the server initiate outbound network connections to arbitrary destinations without sufficient validation. This allows the attacker to probe internal hosts and ports for reachability. The vulnerability has a low severity score and does not impact confidentiality, integrity, or availability beyond limited information disclosure about network reachability.

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-48952