What’s Vulnerable › Vulnerabilities

CVE-2026-76406: Information Disclosure through REST API Authentication in Splunk SOAR

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-29
• Weakness: CWE-203

Description

In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data. The vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks. The attack requires the unauthenticated user to have encrypted credential data from an affected Splunk SOAR instance. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises) in the Splunk documentation.

Affected products

• Splunk SOAR: before 8.7.0 — fixed in 8.7.0
• Splunk SOAR: before 8.7.0 — fixed in 8.7.0

How to fix

Upgrade to a fixed version: Splunk SOAR 8.7.0; Splunk SOAR 8.7.0. Check the vendor advisory for mitigations.

References

• https://advisory.splunk.com/advisories/SVD-2026-1010

Get alerted when CVE-2026-76406 or the next vulnerability affects your stack