SOAR - Git pull spool task deserialization failure leaves source control repositories locked

Available Languages

Updated:October 1, 2026
Document ID:SPLK055108

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk SOAR 8.5.2 and 8.6.0

Description

In SOAR Playbooks web page, initiated a source control pull by clicking the Update from Source Control button. The operation remained running after selecting the intended repository, toggled Preserve State, and a message was displayed "A repository clone/pull is currently running.” 

 


Investigation

The initial SCM pull requests return HTTP 200, but the asynchronous Git pull task immediately fails while uWSGI attempts to deserialize its spool payload:

 
 
_pickle.UnpicklingError: pickle data was truncated 
...
File "/opt/phantom/usr/lib/platform/lib/python3.13/site-packages/uwsgidecorators.py", line 58, in manage_spool_request vars[k] = pickle.loads(vars.pop(k))
 
Subsequent pull attempts are rejected with: 
This repository is currently being cloned/updated and updates are not allowed until the currently running operation completes.

This has been identified as a product issue in the platform affecting SOAR 8.5.2 and 8.6.0. The source control pull is handed to a background task, and in certain configurations that task's payload exceeds an internal size limit and it is silently discarded.


Resolution

The issue is expected to be fixed in SOAR release 8.8. A workaround is to manually pull with the following curl command which uses a synchronous path that should not be affected by the issue.

 
curl -u '<USERNAME>' \ -X POST https://<SOAR_URL>/playbooks \ -H 'Content-Type: application/json' \ -d '{"sync": true, "scm_id": <SCM_ID>}'

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Articles