Information disclosure in Splunk Security Orchestration, Automation and Response (SOAR) - CVE-2026-76306
Published: October 22, 2026
Vulnerability identifier: #VU157061
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76306
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to infer other users' password hashes and authorization tokens, potentially enabling unauthorized access, data modification, and service disruption.
The vulnerability exists due to exposure of sensitive user record fields in Splunk SOAR's REST API when applying query filters before protecting those fields from query processing. A remote user can use the Observer role to submit query filters targeting sensitive fields to infer password hashes and authorization tokens, potentially compromising the confidentiality, integrity, and availability of the instance through unauthorized access.
Affected software
Splunk Security Orchestration, Automation and Response (SOAR)
How to mitigate CVE-2026-76306
Install security update from vendor's website.
Splunk Security Orchestration, Automation and Response (SOAR) - update to 8.7.0