CVE-2026-76370: Information Disclosure through the REST API in Splunk SOAR
In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer (REST) API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not enforce role-based tenant restrictions when it returns tenant information through the REST API in deployments with multi-tenancy turned on. For more information see REST Roles and Permissions (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/role-management-endpoints/rest-roles-and-permissions) and Configure multiple tenants on your Splunk SOAR (On-premises) instance (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/configure-product-settings-for-your-splunk-soar-on-premises-instance/configure-multiple-tenants-on-your-splunk-soar-on-premises-instance) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOARto a version that resolves this vulnerability.Fixed in 8.6.0
Event History
Frequently Asked Questions
Which deployments are affected?
The issue applies to Splunk SOAR deployments with multi-tenancy enabled and versions below 8.6.0. Single-tenant deployments are not identified as affected by the provided information.
What access does an attacker need?
An attacker needs an authenticated Splunk SOAR account with restricted tenant access. They can use the REST API without user interaction to retrieve names and identifiers for tenants outside their assigned role scope.
What information could be exposed?
The disclosed data is limited to tenant names and tenant identifiers. The provided information does not indicate exposure of tenant contents or modification capabilities.
How can we determine whether we may be affected?
Check whether the Splunk SOAR version is below 8.6.0 and whether multi-tenancy is enabled. In that configuration, review REST API access by restricted-tenant users for responses containing tenant names or identifiers outside their authorized scope.