Information disclosure through REST API query filters in Splunk SOAR
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Splunk SOAR versions before 8.7.0 expose sensitive user record fields through REST API query filters. Splunk SOAR applies query filters to user records before it protects sensitive fields, which is an exposure of sensitive information (CWE-200). A user with the Observer role can use query filters to infer password hashes and authorization tokens for other users.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users. The information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Splunk SOAR to 8.7.0, the fixed version listed for Splunk SOAR.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA Splunk SOAR (Splunk) Fixed in 8.7.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Splunk SOAR 8.7.0
15 records Highest priority Priority MEDIUM 8 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-79051 Improper protection of alternate path in Splunk SOARPriority MEDIUM 49
- TI-2026-79050 Protection mechanism failure in Splunk SOARPriority MEDIUM 49
- TI-2026-79049 Improper exception handling in Splunk SOARPriority MEDIUM 49
Timeline
- 2026-10-21 Threatist record created from CVE-2026-76306
- 2026-10-22 Alias added: GHSA-cm97-8h22-4fq2
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-11-02 CISA SSVC decision points changed
References
More Splunk vulnerabilities
- TI-2026-16444 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise KEVCVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2023-24841 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing CVSS 3.1HIGH 8.8
- TI-2023-12257 Injection in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
- TI-2022-13930 Information disclosure in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
- TI-2022-13917 Incorrect default permissions in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-76306 · CVE Program
- CVE-2026-76306 · NVD
- FIRST EPSS
- GHSA-cm97-8h22-4fq2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences