CVE-2026-76356: Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR
In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that the request originates from the local system. Successful exploitation can expose all relevant data, affect system integrity, and disrupt service availability. For more information see About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOAR Automation Brokerto a version that resolves this vulnerability.Fixed in 8.6.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Splunk SOAR versions below 8.6.0 are affected where the Automation Broker notification endpoint is reachable by an unauthenticated attacker. The issue exists because the endpoint trusts a client-supplied source IP address header to establish that a request came from the local system.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to send a crafted request to the Automation Broker notification endpoint with a spoofed source IP address header.
What is the impact of successful exploitation?
Successful exploitation allows arbitrary code execution on the Splunk SOAR host. This can expose relevant data, alter system integrity, and disrupt service availability.