Stored cross-site scripting in Splunk SOAR app documentation
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Splunk SOAR versions before 8.7.0 do not sanitize app documentation content before displaying it, enabling stored cross-site scripting (CWE-79). A user with the install_apps capability can store attacker-controlled content by installing an app, and it runs in the browser of another user with permission to view apps who opens that app's documentation. The attacker must phish the affected user into initiating a request in their browser, and the attacker can then access data and make changes with the victim's privileges.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app. If another user who holds a role with permission to view apps opens the app documentation, Splunk SOAR could run that content in the browser of the user who opened the app documentation. With this access, the first user could access data and make changes that the user who opened the app documentation could make. The vulnerability is possible because Splunk SOAR does not sanitize app documentation content before it displays that content. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user that holds a role with the install_apps capability should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.6.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises) in the Splunk documentation.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Splunk SOAR to version 8.7.0 or later, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA Splunk SOAR (Splunk) Fixed in 8.7.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Splunk SOAR 8.7.0
15 records Highest priority Priority MEDIUM 8 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-79051 Improper protection of alternate path in Splunk SOARPriority MEDIUM 49
- TI-2026-79050 Protection mechanism failure in Splunk SOARPriority MEDIUM 49
- TI-2026-79049 Improper exception handling in Splunk SOARPriority MEDIUM 49
Timeline
- 2026-10-21 Threatist record created from CVE-2026-76303
- 2026-10-22 Alias added: GHSA-mr43-r8rx-5q4q
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-23 CISA SSVC decision points changed
- 2026-11-05 CVSS score added · NVD
References
More Splunk Soar vulnerabilities
- TI-2026-53411 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR CVSS 3.1HIGH 8.1
- TI-2023-03711 Unauthenticated Log Injection In Splunk SOAR CVSS 3.1HIGH 8.6
- TI-2026-53417 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR CVSS 3.1HIGH 7.4
- TI-2026-53412 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR CVSS 3.1HIGH 7.6
- TI-2026-53420 Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR CVSS 3.1MEDIUM 6.5
- TI-2026-53419 Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-76303 · CVE Program
- CVE-2026-76303 · NVD
- FIRST EPSS
- GHSA-mr43-r8rx-5q4q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences