CVE-2026-20260

Log Injection through HTTP Request Paths in Splunk SOAR

Severity
Medium 4.3
CVSS 3.1
Exploited
Not listed
EPSS
0.002
9.9th percentile
Discovered by
Not disclosed
Published
Jun 10, 2026
Assigned by cisco

Description

In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might interpret when an administrator views the logs.<br><br>The injection is possible because SOAR does not strip control characters from HTTP request paths before writing them to application logs.

Weakness: CWE-117

Affected products

Vendor Product Category Matched by

No product mapping yet — this CVE is pending taxonomy review.

Vendor-reported affected versions (1)
  • Splunk · Splunk SOAR

Credit

STÖK / Fredrik Alexandersson