CVE-2026-76366: Information Disclosure through the REST API in Splunk SOAR
In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR does not block REST API filters from matching values that responses otherwise hide. For more information see REST Run Playbook (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/run-playbook-endpoints/rest-run-playbook) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid Splunk SOAR account and access to use REST API filtering on playbook runs. The disclosed session tokens can expose all data available to that same affected user.
Which deployments are affected?
Splunk SOAR versions below 8.6.0 are affected. The issue is in REST API filtering for playbook-run data, where filters can match values that are otherwise hidden from responses.
What is the immediate mitigation if upgrading is not possible?
The provided information does not identify a configuration workaround. Restrict REST API access and filtering on playbook runs for accounts that do not require it, and limit account permissions to reduce the data accessible through any recovered token.