CVE-2026-76370

Received Received - Intake

Information Disclosure in Splunk SOAR via REST API

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer (REST) API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not enforce role-based tenant restrictions when it returns tenant information through the REST API in deployments with multi-tenancy turned on. For more information see REST Roles and Permissions (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/role-management-endpoints/rest-roles-and-permissions) and Configure multiple tenants on your Splunk SOAR (On-premises) instance (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/configure-product-settings-for-your-splunk-soar-on-premises-instance/configure-multiple-tenants-on-your-splunk-soar-on-premises-instance) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76370

EUVD

EUVD-2026-62935

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_soar	to 8.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Splunk SOAR versions below 8.6.0 allows an authenticated user with restricted tenant access to view tenant names and identifiers outside their role scope via the REST API. It occurs because tenant restrictions are not enforced when returning tenant information in multi-tenant deployments.

Detection Guidance

Detecting this vulnerability requires checking Splunk SOAR REST API responses for unauthorized tenant information access. Monitor API logs for requests to tenant-related endpoints and verify if restricted users can retrieve tenant names outside their scope. Use Splunk SOAR's built-in logging and audit tools to review REST API calls and responses.

Impact Analysis

An attacker with restricted access could enumerate tenant names and IDs, potentially revealing sensitive system structure or enabling further attacks by identifying targets outside their permitted scope.

Compliance Impact

This vulnerability may violate data access controls required by GDPR and HIPAA by allowing unauthorized disclosure of tenant information, potentially exposing sensitive data or system configurations to unauthorized users.

Mitigation Strategies

Upgrade Splunk SOAR to version 8.6.0 or later to address the vulnerability. If upgrading is not immediately possible, restrict multi-tenancy access or disable multi-tenancy until the update is applied. Review and tighten role-based access controls to ensure tenants are properly scoped.

Hi! I’m here to help you understand CVE-2026-76370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70