Information disclosure via REST API authentication in Splunk SOAR
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-203.
Summary
Splunk SOAR versions before 8.7.0 are affected. The REST API decrypts encrypted Basic authentication values before it completes authentication checks, which is an observable discrepancy (CWE-203). An unauthenticated attacker who has encrypted credential data from an affected instance can use the REST API to expose and decrypt that credential data.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data. The vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks. The attack requires the unauthenticated user to have encrypted credential data from an affected Splunk SOAR instance. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises) in the Splunk documentation.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Splunk SOAR 8.7.0 fixes this issue, so upgrade affected instances to version 8.7.0 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Splunk SOAR (Splunk) Fixed in 8.7.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Splunk SOAR 8.7.0
15 records Highest priority Priority MEDIUM 8 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-79051 Improper protection of alternate path in Splunk SOARPriority MEDIUM 49
- TI-2026-79050 Protection mechanism failure in Splunk SOARPriority MEDIUM 49
- TI-2026-79049 Improper exception handling in Splunk SOARPriority MEDIUM 49
Timeline
- 2026-10-21 Threatist record created from CVE-2026-76406
- 2026-10-22 Alias added: GHSA-p22x-wc3v-hrj6
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-28 CISA SSVC decision points changed
References
More Splunk Soar vulnerabilities
- TI-2026-53411 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR CVSS 3.1HIGH 8.1
- TI-2023-03711 Unauthenticated Log Injection In Splunk SOAR CVSS 3.1HIGH 8.6
- TI-2026-53417 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR CVSS 3.1HIGH 7.4
- TI-2026-53412 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR CVSS 3.1HIGH 7.6
- TI-2026-53420 Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR CVSS 3.1MEDIUM 6.5
- TI-2026-53419 Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-76406 · CVE Program
- CVE-2026-76406 · NVD
- FIRST EPSS
- GHSA-p22x-wc3v-hrj6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences