CVE-2026-20260

The record

In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might interpret when an administrator views the logs.<br><br>The injection is possible because SOAR does not strip control characters from HTTP request paths before writing them to application logs.

Affected packages

Related vulnerabilities

• CVE-2026-109786 In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter… CWE-117
• CVE-2026-87859 morgan is an HTTP request logger middleware for Node.js. CWE-117
• CVE-2026-14350 IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an… CWE-117
• CVE-2026-9736 IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to… CWE-117
• CVE-2026-15603 morgan is an HTTP request logger middleware for Node.js. CWE-117
• CVE-2026-81694 openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from… CWE-117
• CVE-2026-81695 openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values… CWE-117
• CVE-2026-81696 openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in… CWE-117