CVE-2026-76390: Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cisco Talos Intelligence for Enterprise Security Cloudto a version that resolves this vulnerability.Fixed in 1.0.3
Event History
Frequently Asked Questions
Who can access the exposed information?
Any unauthenticated user who can reach Splunk Web can access the add-on OpenAPI specification through static file paths in affected versions below 1.0.3.
What can an attacker learn from the exposed specification?
The specification can provide reconnaissance information about the add-on REST API endpoints and its authentication model. The provided information describes disclosure only, not unauthorized API access or modification.
Is authentication required to exploit this issue?
No. Splunk Web serves the generated OpenAPI specification from a static file path without authentication in affected versions.
What configuration condition causes the exposure?
The issue occurs because the generated OpenAPI specification is packaged in a static file path served by Splunk Web without authentication.