Information disclosure in Splunk Security Orchestration, Automation and Response (SOAR) - CVE-2026-76307
Published: October 22, 2026
Vulnerability identifier: #VU157062
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76307
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to infer other users' authentication tokens and potentially gain administrative access, enabling disclosure or modification of data and disruption of service.
The vulnerability exists due to exposure of sensitive user record fields in Splunk SOAR's REST API when processing caller-controlled query filters. A remote privileged user can use the Users and Roles view permission to submit filters targeting sensitive fields to infer authentication tokens and, if a recovered token grants administrative access, take administrative control of the instance.
Affected software
Splunk Security Orchestration, Automation and Response (SOAR)
How to mitigate CVE-2026-76307
Install security update from vendor's website.
Splunk Security Orchestration, Automation and Response (SOAR) - update to 8.7.0