Description
A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter.


This vulnerability was patched in version 6.3.85, and no customer action is needed.
Published: 2026-08-17
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A blind SQL injection flaw exists in the legacy dashboard widget API of Google SecOps Chronicle SOAR, allowing an authenticated user to craft request parameters that are directly incorporated into SQL queries. The vulnerability can lead to unauthorized database access, data extraction or manipulation, and potentially broader system compromise. This weakness is identified as CWE‑89.

Affected Systems

The flaw affects Google Cloud Google SecOps (Chronicle SOAR) deployments running any version prior to 6.3.85. Customers using older releases of the dashboard widget API are susceptible until they upgrade to the patched version.

Risk and Exploitability

With a CVSS score of 9.4, the risk is high. The EPSS is currently not available, and the issue is not listed in CISA’s KEV catalog, indicating no widespread exploitation evidence at this time. An attacker must be authenticated to the service and must interact with the legacy dashboard widget endpoint to send malicious parameters, after which blind SQL queries can be executed against the underlying database.

Generated by OpenCVE AI on August 17, 2026 at 08:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • No action required; the vulnerability has been patched in version 6.3.85.
  • Continue to follow Google Cloud security best practices and monitor official advisories for updates.
  • Ensure your deployments remain compliant with the latest security updates from Google Cloud.

Generated by OpenCVE AI on August 17, 2026 at 08:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Google Cloud
Google Cloud google Secops (chronicle Soar)
Vendors & Products Google Cloud
Google Cloud google Secops (chronicle Soar)

Mon, 17 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Description A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. This vulnerability was patched in version 6.3.85, and no customer action is needed.
Title Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear'}

Subscriptions

Google Cloud Google Secops (chronicle Soar)
cve-icon MITRE

Status: PUBLISHED

Assigner: GoogleCloud

Published:

Updated: 2026-08-17T15:23:57.708Z

Reserved: 2026-07-13T17:22:36.577Z

Link: CVE-2026-15623

cve-icon Vulnrichment

Updated: 2026-08-17T15:23:52.500Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-17T07:17:12.020

Modified: 2026-08-31T18:50:00.053

Link: CVE-2026-15623

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T08:15:18Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')