Missing Authorization in Splunk Security Orchestration, Automation and Response (SOAR) - CVE-2026-76304
Published: October 22, 2026
Vulnerability identifier: #VU157059
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76304
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose Automation Broker configuration information without the required permission.
The vulnerability exists due to missing authorization in Splunk SOAR's Automation Broker configuration download functionality when handling configuration file requests. A remote user can request the Docker Compose configuration file without the Automation Broker edit permission to obtain the instance URL, container image location, and Automation Broker version.
Affected software
Splunk Security Orchestration, Automation and Response (SOAR)
How to mitigate CVE-2026-76304
Install security update from vendor's website.
Splunk Security Orchestration, Automation and Response (SOAR) - update to 8.7.0