CVE-2026-76361: Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR
In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The Server-Side Request Forgery (SSRF) is possible because the connectivity check REST API does not sufficiently validate the destination before Splunk SOAR connects to it. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOARto a version that resolves this vulnerability.Fixed in 8.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated Splunk SOAR user assigned the Administrator role. The issue affects Splunk SOAR versions below 8.6.0.
What could an attacker do with this access?
An Administrator could use the connectivity-check REST endpoint to cause Splunk SOAR to initiate outbound connections to arbitrary destinations. This can be used to determine whether internal hosts and ports are reachable.
Is a default deployment exposed?
The available information identifies exposure based on version and Administrator-role access, not on a specific optional configuration. Deployments below 8.6.0 should assess whether Administrator accounts can access the connectivity-check REST API.
What is the immediate mitigation if upgrading is not possible?
Limit Administrator-role assignment to trusted users, since Administrator access is required for exploitation. Review and restrict access to the connectivity-check REST API where operationally feasible.