CVE-2026-76361 Overview
CVE-2026-76361 is a Server-Side Request Forgery (SSRF) vulnerability in Splunk SOAR versions below 8.6.0. An authenticated user holding the Administrator role can abuse the /rest/support/connectivity/.../check_connectivity REST endpoint to force Splunk SOAR to initiate outbound network connections to arbitrary destinations. The flaw allows an attacker to probe internal hosts and ports, revealing reachability of otherwise unexposed services. The vulnerability is tracked under [CWE-918] and requires high privileges, which limits practical exploitation to users already trusted at the administrative level.
Critical Impact
An authenticated administrator can leverage Splunk SOAR to perform internal network reconnaissance by forcing outbound connections to arbitrary destinations.
Affected Products
- Splunk SOAR (On-premises) versions below 8.6.0
- Splunk SOAR connectivity check REST API component
- Systems reachable from the Splunk SOAR host network segment
Discovery Timeline
- 2026-08-19 - CVE-2026-76361 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76361
Vulnerability Analysis
The vulnerability resides in the connectivity check REST API exposed at /rest/support/connectivity/.../check_connectivity. This endpoint is designed to help administrators validate outbound network reachability from the Splunk SOAR instance. The endpoint fails to sufficiently validate the destination address supplied by the caller before Splunk SOAR opens a connection to it. As a result, an attacker with the Administrator role can direct connection attempts to internal IP addresses, loopback interfaces, and cloud metadata endpoints.
The response or timing behavior of the connectivity check reveals whether internal hosts and ports are reachable. This turns the endpoint into a reconnaissance primitive against network segments that the attacker cannot reach directly. The attack requires network access to the Splunk SOAR management interface and valid administrator credentials.
Root Cause
The root cause is missing destination validation in the connectivity check handler. The endpoint accepts arbitrary host and port values without enforcing an allowlist, blocking private IP ranges, or restricting protocols. This maps to [CWE-918] Server-Side Request Forgery.
Attack Vector
An authenticated administrator submits a crafted request to the connectivity check endpoint specifying an internal destination such as 127.0.0.1, an RFC1918 address, or a cloud metadata service address. Splunk SOAR then attempts the connection on behalf of the attacker. Success or failure signals reveal internal network topology and service availability.
See the Splunk Security Advisory SVD-2026-0804 for vendor technical details.
Detection Methods for CVE-2026-76361
Indicators of Compromise
- Requests to /rest/support/connectivity/.../check_connectivity referencing internal, loopback, or link-local addresses such as 127.0.0.1, 169.254.169.254, or RFC1918 ranges
- Repeated connectivity check requests from a single administrator session enumerating multiple hosts or ports
- Outbound TCP connection attempts originating from the Splunk SOAR service account to unexpected internal destinations
Detection Strategies
- Review Splunk SOAR audit logs for check_connectivity REST calls and correlate the target parameters against expected diagnostic activity
- Alert on any connectivity check invocation targeting metadata service IPs or internal management subnets
- Monitor network flow data for connections from the SOAR host to destinations outside its documented integration baseline
Monitoring Recommendations
- Baseline legitimate administrator use of the connectivity check endpoint and flag deviations
- Forward SOAR API access logs to a centralized SIEM for correlation with authentication events
- Track administrator account behavior for signs of credential compromise or insider misuse
How to Mitigate CVE-2026-76361
Immediate Actions Required
- Upgrade Splunk SOAR to version 8.6.0 or later per the vendor advisory
- Audit accounts assigned the Administrator role and remove unnecessary privileges
- Rotate credentials for administrator accounts if suspicious connectivity check activity is observed
- Restrict network access to the Splunk SOAR management interface to trusted administrative networks
Patch Information
Splunk has addressed the SSRF in Splunk SOAR 8.6.0. Refer to the Splunk Security Advisory SVD-2026-0804 for the full list of fixed versions and upgrade guidance. Operators running versions below 8.6.0 should plan an upgrade window and validate integrations after patching.
Workarounds
- Apply strict role-based access control and limit membership in the Administrator role to a minimal set of trusted operators
- Place Splunk SOAR behind egress filtering that blocks outbound connections to internal management ranges and cloud metadata services
- Enable enhanced audit logging for REST API calls to the connectivity check endpoint until the patch is deployed
# Example egress filter blocking SOAR access to cloud metadata and loopback
iptables -A OUTPUT -m owner --uid-owner phantom -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner phantom -d 127.0.0.0/8 ! -o lo -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
