# CVE-2026-20260: Log Injection through HTTP Request Paths in Splunk SOAR > CVE-2026-20260: Log Injection through HTTP Request Paths in Splunk SOAR. CVSS 4.3 (CVSS 3.1). Canonical: https://rewindex.com/cve/CVE-2026-20260 Last updated: 2026-06-17T10:17:21Z - Published: 2026-06-10 17:16 UTC · Updated: 2026-06-17 10:17 UTC · Assigner: cisco - CVSS: 4.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - EPSS: 0.20%, 10th percentile (scored 2026-10-25) - CISA KEV: no - CWE: CWE-117 ## Description In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might interpret when an administrator views the logs.\\The injection is possible because SOAR does not strip control characters from HTTP request paths before writing them to application logs. ## Affected vendors and products - Splunk: Splunk SOAR ## Tracked companies - [Splunk](https://rewindex.com/company/splunk.md) ## References - [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-20260) - [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-20260) - [https://advisory.splunk.com/advisories/SVD-2026-0611](https://advisory.splunk.com/advisories/SVD-2026-0611) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ --- Canonical: https://rewindex.com/cve/CVE-2026-20260 · Markdown: https://rewindex.com/cve/CVE-2026-20260.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-20260 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:11:12.679Z