Security Vulnerabilities in Splunk SOAR - October 2026
Advisory ID: SVD-2026-1010
Published: 2026-10-21
Highest CVSSv3.1 Score: 7.5, High
Last Updated: 2026-10-21
Description
Splunk addressed multiple vulnerabilities in Splunk SOAR version 8.7.0. See CVE Details for vulnerability-specific affected versions, additional remediation, acknowledgments, and workarounds.
Solutions
Upgrade Splunk SOAR to version 8.7.0 or higher.
Product Status
| Product | Base Version | Affected Version | Fix Version |
|---|---|---|---|
| Splunk SOAR | 8.7 | Below 8.7.0 | 8.7.0 |
Vulnerabilities
| CVE | Summary | CWE | Severity | Score |
|---|---|---|---|---|
| CVE-2026-76303 | Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR | CWE-79 | Medium | 5.7 |
| CVE-2026-76304 | Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR | CWE-862 | Medium | 4.3 |
| CVE-2026-76305 | Improper Access Control during App Downloads in Splunk SOAR | CWE-862 | Medium | 6.5 |
| CVE-2026-76306 | Information Disclosure through REST API Query Filters in Splunk SOAR | CWE-200 | High | 7.5 |
| CVE-2026-76307 | Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR | CWE-200 | High | 7.2 |
| CVE-2026-76308 | Missing Authorization through the REST API in Splunk SOAR | CWE-862 | Medium | 6.5 |
| CVE-2026-76406 | Information Disclosure through REST API Authentication in Splunk SOAR | CWE-203 | Medium | 5.9 |
CVE Details
CVE-2026-76303: Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR
Description
In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app. If another user who holds a role with permission to view apps opens the app documentation, Splunk SOAR could run that content in the browser of the user who opened the app documentation. With this access, the first user could access data and make changes that the user who opened the app documentation could make. The vulnerability is possible because Splunk SOAR does not sanitize app documentation content before it displays that content. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user that holds a role with the install_apps capability should not be able to exploit the vulnerability at will. For more information see Manage roles and permissions in Splunk SOAR (On-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) in the Splunk documentation.
Bug ID: VULN-71409
CWE: CWE-79
CVSSv3.1 Score: 5.7, Medium
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Mitigations and Workarounds
None
Acknowledgments: Gabriel Nitu, Splunk
CVE-2026-76304: Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR
Description
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Uniform Resource Locator (URL) of the Splunk SOAR instance, the container image location, and the Splunk SOAR Automation Broker version. The vulnerability is possible because Splunk SOAR returns the configuration file without enforcing the Automation Broker edit permission. For more information see Install Splunk Automation Broker on a Docker host and Manage roles and permissions in Splunk SOAR (On-premises) in the Splunk documentation.
Bug ID: VULN-81787
CWE: CWE-862
CVSSv3.1 Score: 4.3, Medium
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Mitigations and Workarounds
None
Acknowledgments: Gabriel Nitu, Splunk
CVE-2026-76305: Improper Access Control during App Downloads in Splunk SOAR
Description
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information. The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive. For more information see Export or import an app and Manage roles and permissions in Splunk SOAR (On-premises) in the Splunk documentation.
Bug ID: VULN-71537
CWE: CWE-862
CVSSv3.1 Score: 6.5, Medium
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Mitigations and Workarounds
None
Acknowledgments: Gabriel Nitu, Splunk
CVE-2026-76306: Information Disclosure through REST API Query Filters in Splunk SOAR
Description
In Splunk SOAR versions below 8.7.0, a user that has the “Observer” role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users. The information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing. For more information see Using the REST API reference for Splunk SOAR (On-premises), Query for Data, and Manage roles and permissions in Splunk SOAR (On-premises) in the Splunk documentation.
Bug ID: VULN-71097
CWE: CWE-200
CVSSv3.1 Score: 7.5, High
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Mitigations and Workarounds
None
Acknowledgments: Brandon Rossi (conda)
CVE-2026-76307: Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR
Description
In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance. The vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields. For more information see Using the REST API reference for Splunk SOAR (On-premises), Query for Data, and Manage roles and permissions in Splunk SOAR (On-premises) in the Splunk documentation.
Bug ID: VULN-45342
CWE: CWE-200
CVSSv3.1 Score: 7.2, High
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Mitigations and Workarounds
None
Acknowledgments: Eric Li, Splunk
CVE-2026-76308: Missing Authorization through the REST API in Splunk SOAR
Description
In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change. The vulnerability is possible because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before it applies the license change. For more information see Using the REST API reference for Splunk SOAR (On-premises), Obtain and configure a Splunk SOAR (On-premises) license, and Integration of Splunk SOAR with Splunk Enterprise Security in the Splunk documentation.
Bug ID: VULN-76121
CWE: CWE-862
CVSSv3.1 Score: 6.5, Medium
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Mitigations and Workarounds
None
Acknowledgments: Gabriel Nitu, Splunk
CVE-2026-76406: Information Disclosure through REST API Authentication in Splunk SOAR
Description
In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data. The vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks. The attack requires the unauthenticated user to have encrypted credential data from an affected Splunk SOAR instance. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Using the REST API reference for Splunk SOAR (On-premises) in the Splunk documentation.
Bug ID: VULN-54136
CWE: CWE-203
CVSSv3.1 Score: 5.9, Medium
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigations and Workarounds
None
Acknowledgments: Eric Li, Splunk