CVE-2026-20260 Log Injection through HTTP Request Paths in Splunk SOAR
Unauthenticated attackers can inject ANSI escape codes into Splunk SOAR logs via HTTP paths, potentially executing code when administrators view logs in terminal emulators.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-20260?
CVE-2026-20260 is a medium-severity vulnerability in Splunk SOAR, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might interpret when an administrator views the logs.<br><br>The injection is possible because SOAR does not strip control characters from HTTP request paths before writing them to application logs.
Weakness: CWE-117
Which versions are affected by CVE-2026-20260?
How do I fix CVE-2026-20260?
No fix has been published for CVE-2026-20260 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-20260 being exploited?
There is no known exploitation of CVE-2026-20260 in the wild and no public exploit code.
Sources
Also known as GHSA-7m5m-884p-fv5r.