CVE-2026-76358: Splunk SOAR Path Traversal Vulnerability

CVE-2026-76358 Overview

CVE-2026-76358 is a path traversal vulnerability in Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.6.0. An authenticated user holding app-install privileges can abuse the archive extraction routine used during app installation. The routine does not validate that extracted file paths remain within the intended destination directory, allowing files to be written outside the temporary directory used for staging.

The weakness maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. Successful exploitation can compromise the integrity and availability of the SOAR host by writing attacker-controlled files to arbitrary filesystem locations accessible to the SOAR service account.

Critical Impact
An authenticated user with app-install privileges can write files outside the intended extraction directory, potentially overwriting sensitive files on the Splunk SOAR host and impacting integrity and availability.

Affected Products

Splunk SOAR (On-premises) versions below 8.6.0
Splunk SOAR app installation subsystem
Deployments where non-administrative roles are granted the app-install permission

Discovery Timeline

2026-08-19 - CVE-2026-76358 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database
2026-08-19 - Splunk publishes advisory SVD-2026-0804

Technical Details for CVE-2026-76358

Vulnerability Analysis

Splunk SOAR distributes automation functionality through installable apps that are packaged as archives. When a user with the app-install privilege uploads an app, the platform extracts the archive contents into a temporary directory before validation and registration.

The extraction routine trusts the file paths declared inside the archive. It does not canonicalize or verify that each resolved path stays within the intended destination directory. An archive entry containing sequences such as ../ or an absolute path can escape the temporary directory during extraction.

The result is arbitrary file write on the SOAR host under the privileges of the service account running the extraction process. Attackers can overwrite configuration files, drop executable payloads into paths referenced by scheduled tasks or service loaders, or corrupt files required for platform operation.

Root Cause

The root cause is missing path validation during archive extraction. The routine writes each entry to the concatenation of the destination directory and the archive-declared name without validating that the final resolved path is a descendant of the destination directory. This is a classic Zip Slip pattern tracked as [CWE-22].

Attack Vector

Exploitation requires an authenticated account with app-install privileges on the target Splunk SOAR instance. The attacker crafts a malicious app archive containing entries whose paths traverse outside the extraction directory. Uploading and installing the app triggers extraction and writes attacker-controlled content to arbitrary locations on the host filesystem.

No verified public exploit code is available at the time of publication. See the Splunk Security Advisory SVD-2026-0804 for vendor technical details.

Detection Methods for CVE-2026-76358

Indicators of Compromise

App archive uploads submitted by non-administrative accounts, especially uploads followed by installation errors or partial failures
Files created outside the standard Splunk SOAR app installation directory tree by the SOAR service account
Modifications to configuration files, cron entries, or systemd units on the SOAR host timestamped near an app installation event
Audit log entries showing app-install actions from accounts that do not normally manage apps

Detection Strategies

Inspect uploaded app archives for entries containing ../ sequences, absolute paths, or symbolic links before installation
Correlate SOAR audit logs of app installation events with filesystem write events on the underlying host
Alert on any file creation by the SOAR service account outside the documented app installation and working directories

Monitoring Recommendations

Enable and forward Splunk SOAR audit logs to a centralized logging platform for review of app-install actions
Monitor the SOAR host filesystem with file integrity monitoring covering system directories, service unit paths, and user home directories
Track role assignments and alert when the app-install permission is granted to new accounts or roles

How to Mitigate CVE-2026-76358

Immediate Actions Required

Upgrade Splunk SOAR (On-premises) to version 8.6.0 or later as documented in SVD-2026-0804
Audit all roles that grant the app-install permission and remove it from accounts that do not require it
Restrict app installation to trusted administrators and require review of any uploaded app archives from external sources

Patch Information

Splunk has fixed the path traversal in Splunk SOAR version 8.6.0. Refer to the vendor advisory SVD-2026-0804 for supported upgrade paths and package availability. Splunk documentation on managing roles and permissions and adding and configuring apps provides operational guidance.

Workarounds

Remove the app-install privilege from all non-administrative roles until the upgrade to 8.6.0 is complete
Install only apps sourced from Splunkbase or other trusted publishers and validate archive contents before upload
Isolate the Splunk SOAR host with least-privilege service accounts and restrictive filesystem permissions to limit the blast radius of an arbitrary file write

bash

# Configuration example: inspect a Splunk SOAR app archive for path traversal entries before installation
tar -tzf suspect_app.tgz | awk '/(^\/|\.\.\/)/ {print "UNSAFE ENTRY:", $0; found=1} END {exit !found}'