What’s Vulnerable › Vulnerabilities
CVE-2026-76366: Information Disclosure through the REST API in Splunk SOAR
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-19 · updated 2026-08-21
- Weakness: CWE-200
Description
In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR does not block REST API filters from matching values that responses otherwise hide. For more information see REST Run Playbook (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/run-playbook-endpoints/rest-run-playbook) in the Splunk documentation.
Affected products
- Splunk SOAR: before 8.6.0 — fixed in 8.6.0
How to fix
Upgrade to a fixed version: Splunk SOAR 8.6.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-76366 or the next vulnerability affects your stack