CVE-2026-76356: Splunk SOAR RCE Vulnerability

CVE-2026-76356 Overview

CVE-2026-76356 is an authentication bypass vulnerability in Splunk SOAR versions below 8.6.0. The Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that a request originates from the local system. An unauthenticated attacker can spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The weakness is classified under [CWE-290: Authentication Bypass by Spoofing]. Successful exploitation exposes sensitive data, compromises host integrity, and disrupts service availability.

Critical Impact
Unauthenticated remote code execution on the Splunk SOAR host through spoofed source IP headers sent to the Automation Broker notification endpoint.

Affected Products

Splunk SOAR versions below 8.6.0
Splunk SOAR Automation Broker component
On-premises Splunk SOAR deployments exposing the notification endpoint

Discovery Timeline

2026-08-19 - CVE-2026-76356 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76356

Vulnerability Analysis

The Splunk SOAR Automation Broker exposes a notification endpoint intended for local, trusted callers. The endpoint enforces this trust boundary by inspecting a client-supplied HTTP header that identifies the source IP address. When the header value matches a local or loopback address, the request is treated as authenticated and privileged. Because the header is attacker-controlled, remote unauthenticated clients can forge it and bypass the intended local-only restriction.

Once past the trust check, request handlers accept parameters that drive command execution on the underlying host. The result is arbitrary code execution in the security context of the Automation Broker service. Given the role of Splunk SOAR in security orchestration, a compromised host exposes integrations, credentials, playbooks, and downstream systems.

Root Cause

The root cause is improper source identity verification. The Automation Broker relies on a header value rather than the actual TCP peer address or a cryptographic authentication mechanism. This design assumes intermediaries or clients cannot set the header, which does not hold when the endpoint is reachable over the network.

Attack Vector

Exploitation requires network access to the Automation Broker notification endpoint. The attacker crafts an HTTP request that includes the spoofed source IP header with a loopback or otherwise trusted value. The request body carries the payload interpreted by the vulnerable handler, leading to command execution. No credentials or user interaction are required, though the attack complexity is rated high because the attacker must reach the endpoint and target the correct notification interface. See the Splunk Security Advisory SVD-2026-0804 for vendor technical details.

Detection Methods for CVE-2026-76356

Indicators of Compromise

HTTP requests to Automation Broker notification endpoints containing source IP headers with 127.0.0.1, localhost, or internal addresses originating from external network segments.
Unexpected child processes spawned by the Automation Broker service account on the Splunk SOAR host.
Outbound network connections from the SOAR host to unfamiliar destinations following notification endpoint requests.
New or modified playbooks, integrations, or scheduled tasks that were not deployed by administrators.

Detection Strategies

Inspect reverse proxy and web server logs for requests to the Automation Broker that include X-Forwarded-For, X-Real-IP, or similar headers claiming loopback origin from non-local peers.
Correlate HTTP request logs with process creation events on the SOAR host to identify command execution chains tied to notification endpoint traffic.
Alert on Automation Broker process trees that include shells, scripting interpreters, or system utilities not associated with normal SOAR operations.

Monitoring Recommendations

Enable verbose access logging on the Automation Broker and forward logs to a centralized analytics platform for retention and correlation.
Baseline normal Automation Broker request sources and header values, then alert on deviations such as loopback claims from external IPs.
Monitor SOAR host file integrity for changes to configuration files, credentials, and playbook storage directories.

How to Mitigate CVE-2026-76356

Immediate Actions Required

Upgrade Splunk SOAR to version 8.6.0 or later as documented in the vendor advisory.
Restrict network access to the Automation Broker notification endpoint using firewall rules or network segmentation until patching is complete.
Audit Automation Broker access logs for evidence of spoofed source IP headers or unexpected command execution.
Rotate credentials, API tokens, and integration secrets stored on any potentially affected SOAR host.

Patch Information

Splunk addresses this vulnerability in Splunk SOAR 8.6.0. Refer to Splunk Security Advisory SVD-2026-0804 for the official fix, upgrade guidance, and any interim mitigation steps published by the vendor.

Workarounds

Place the Automation Broker behind a reverse proxy or network access control that strips or overrides client-supplied source IP headers before they reach the endpoint.
Limit Automation Broker exposure to trusted management networks only, blocking direct access from user or internet-facing segments.
Enforce host-based firewall rules that permit notification endpoint traffic only from verified local sources.

bash

# Configuration example: block external access to the Automation Broker notification port
# Replace <BROKER_PORT> with the port used by your deployment and <MGMT_CIDR> with your trusted range
iptables -A INPUT -p tcp --dport <BROKER_PORT> -s <MGMT_CIDR> -j ACCEPT
iptables -A INPUT -p tcp --dport <BROKER_PORT> -j DROP