CVE-2026-76372: Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR
In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the Nmap Scanner connector action manifest classifies the scan network action as read-only even though the action accepts script parameters that can perform write operations. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOAR Nmap Scanner connectorto a version that resolves this vulnerability.Fixed in 3.0.15
Event History
Frequently Asked Questions
Who can exploit this issue?
A Splunk SOAR user with a role that can edit, create, or run playbooks can exploit it by running the scan network action from a Safe Mode playbook.
What conditions are required for exploitation?
The affected Nmap Scanner version must be below 3.0.15, and the user must be able to supply Nmap Scripting Engine script parameters to the scan network action. No user interaction is described.
Why does Safe Mode not prevent the risky behavior?
The connector action manifest marks scan network as read-only, allowing it in a Safe Mode playbook. However, its script parameters can invoke Nmap Scripting Engine scripts capable of write operations, including command execution or other changes on the target system.
Which systems may be affected by the resulting actions?
The potential command execution or changes occur on the target system scanned through the Nmap action. The issue can affect confidentiality, integrity, and availability of that target.