Missing authorization exposes Automation Broker configuration in Splunk SOAR
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Splunk SOAR versions before 8.7.0 let an authenticated user without a role that permits editing Automation Brokers download the Automation Broker Docker Compose configuration file. An attacker with a low-privileged account can obtain the instance URL, the container image location and the Automation Broker version because the file is returned without enforcing the broker edit permission. The flaw is classified as Missing Authorization (CWE-862).
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Uniform Resource Locator (URL) of the Splunk SOAR instance, the container image location, and the Splunk SOAR Automation Broker version. The vulnerability is possible because Splunk SOAR returns the configuration file without enforcing the Automation Broker edit permission. For more information see Install Splunk Automation Broker on a Docker host (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/install-and-create-classic-splunk-soar-automation-brokers/install-splunk-automation-broker-on-a-docker-host) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Splunk SOAR to version 8.7.0 or later, which fixes the issue. The sources do not list a vendor advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Splunk SOAR (Splunk) Fixed in 8.7.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Splunk SOAR 8.7.0
15 records Highest priority Priority MEDIUM 8 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-79051 Improper protection of alternate path in Splunk SOARPriority MEDIUM 49
- TI-2026-79050 Protection mechanism failure in Splunk SOARPriority MEDIUM 49
- TI-2026-79049 Improper exception handling in Splunk SOARPriority MEDIUM 49
Timeline
- 2026-10-21 Threatist record created from CVE-2026-76304
- 2026-10-22 Alias added: GHSA-v2f8-fvmq-5mrh
- 2026-10-26 CISA SSVC decision points changed
References
More Splunk vulnerabilities
- TI-2026-16444 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise KEVCVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2023-24841 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing CVSS 3.1HIGH 8.8
- TI-2023-12257 Injection in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
- TI-2022-13930 Information disclosure in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
- TI-2022-13917 Incorrect default permissions in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-76304 · CVE Program
- CVE-2026-76304 · NVD
- FIRST EPSS
- GHSA-v2f8-fvmq-5mrh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences