CVE-2026-76366

Received Received - Intake

Splunk SOAR REST API Session Token Exposure

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR does not block REST API filters from matching values that responses otherwise hide. For more information see REST Run Playbook (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/run-playbook-endpoints/rest-run-playbook) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76366

EUVD

EUVD-2026-62931

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_soar	to 8.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk SOAR versions below 8.6.0. A user with a valid account can exploit REST API filtering on playbook runs to recover session tokens. This allows access to all data available to the affected user due to improper blocking of filters that expose hidden responses.

Detection Guidance

To detect this vulnerability, monitor Splunk SOAR REST API logs for unusual filtering patterns on playbook runs that may expose session tokens. Check for API requests attempting to access hidden or restricted data fields. Review Splunk SOAR version to confirm it is below 8.6.0.

Impact Analysis

An attacker with valid credentials could gain unauthorized access to sensitive data accessible by the compromised user. This includes all information the user is permitted to view, leading to potential data breaches or leaks.

Compliance Impact

This vulnerability could result in unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, fines, or legal consequences due to compromised user data access.

Mitigation Strategies

Upgrade Splunk SOAR to version 8.6.0 or later to address the vulnerability. Review REST API filtering policies to ensure sensitive data like session tokens is not exposed through improper filtering.

Hi! I’m here to help you understand CVE-2026-76366. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70