CVE-2026-76360: Splunk SOAR Auth Bypass Vulnerability

CVE-2026-76360 Overview

CVE-2026-76360 is a missing authorization vulnerability in Splunk SOAR versions below 8.6.0. An authenticated user with no role assigned can query the /rest/health endpoint to retrieve system and cluster telemetry that should be restricted to administrative or support users. The endpoint fails to verify that the caller holds a role permitted to view system health and cluster state. The flaw is categorized under CWE-862: Missing Authorization.

Critical Impact
An authenticated user without any assigned role can enumerate Splunk SOAR system and cluster telemetry, exposing operational details that should be restricted to administrators.

Affected Products

Splunk SOAR (On-premises) versions below 8.6.0
/rest/health REST API endpoint
Splunk SOAR cluster deployments running vulnerable releases

Discovery Timeline

2026-08-19 - CVE-2026-76360 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database
Vendor advisory - Splunk Security Advisory SVD-2026-0804

Technical Details for CVE-2026-76360

Vulnerability Analysis

The vulnerability resides in the /rest/health endpoint of Splunk SOAR. This endpoint returns system health and cluster state information intended for administrative or support users. The endpoint performs authentication but does not enforce role-based authorization on the returned data.

An attacker who holds a valid Splunk SOAR account with no role assignment can call the endpoint over the network. The response discloses telemetry describing the SOAR deployment, including cluster state. Exposure of this data supports reconnaissance for follow-on attacks against the SOAR platform and connected systems.

The issue is limited to information disclosure. The CVSS vector indicates no impact to integrity or availability, and the confidentiality impact is scoped to the health and cluster telemetry accessible through the endpoint.

Root Cause

The root cause is a missing authorization check on the /rest/health REST route. Splunk SOAR authenticates the request but does not validate that the caller's role grants access to system health and cluster state. Any authenticated principal, including accounts with no role assigned, receives the full response. This maps to CWE-862 (Missing Authorization).

Attack Vector

Exploitation requires network access to the Splunk SOAR REST API and valid credentials for any account, including one with no assigned role. The attacker issues an HTTP request to /rest/health and parses the JSON response containing system and cluster telemetry. No user interaction is required, and no elevated privileges are needed beyond a low-privileged authenticated session.

No public exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Splunk Security Advisory SVD-2026-0804 for vendor-published technical details.

Detection Methods for CVE-2026-76360

Indicators of Compromise

HTTP requests to /rest/health originating from accounts that do not hold administrative or support roles.
Repeated /rest/health queries from a single low-privilege session, indicating scripted enumeration.
Unexpected authenticated sessions from accounts with no role assignment.

Detection Strategies

Review Splunk SOAR access logs for /rest/health requests correlated with the caller's role membership.
Alert when accounts without an administrator or support role successfully retrieve health telemetry.
Baseline normal callers of /rest/health and flag deviations from that set of service and admin accounts.

Monitoring Recommendations

Forward Splunk SOAR REST audit logs to a centralized logging or SIEM platform for retention and correlation.
Monitor authentication events for accounts that exist without an assigned role and disable or remove them.
Track outbound network flows from hosts that queried /rest/health to identify follow-on reconnaissance.

How to Mitigate CVE-2026-76360

Immediate Actions Required

Upgrade Splunk SOAR (On-premises) to version 8.6.0 or later as instructed in the vendor advisory.
Audit all Splunk SOAR user accounts and remove or assign appropriate roles to any account with no role assigned.
Restrict network access to the Splunk SOAR REST API to trusted management networks.

Patch Information

Splunk has addressed the missing authorization check in Splunk SOAR (On-premises) 8.6.0. Administrators should apply the update per the guidance in Splunk Security Advisory SVD-2026-0804. Additional configuration references are available in the Splunk documentation covering role and permission management and system health monitoring for Splunk SOAR On-premises.

Workarounds

Ensure every Splunk SOAR account is provisioned with an explicit, least-privilege role and remove orphaned accounts.
Place the Splunk SOAR REST API behind a reverse proxy or network access control list that restricts callers to administrative subnets.
Rotate credentials for any account suspected of unauthorized access to the /rest/health endpoint.

bash

# Configuration example: restrict access to the Splunk SOAR REST API at the network layer
# Example iptables rule allowing only an admin subnet to reach the SOAR HTTPS port
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP