CVE-2026-76366: Splunk SOAR Information Disclosure Flaw

CVE-2026-76366 Overview

CVE-2026-76366 is an information disclosure vulnerability in Splunk SOAR versions below 8.6.0. An authenticated user with a valid Splunk SOAR account can abuse Representational State Transfer (REST) API filtering on playbook runs to recover session tokens. The disclosed tokens compromise all data accessible to the affected user, enabling account takeover within the SOAR platform. The vulnerability maps to [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Authenticated attackers can extract session tokens through REST API filter queries, exposing all data available to the compromised user account.

Affected Products

Splunk SOAR versions below 8.6.0
Splunk SOAR on-premises deployments
Splunk SOAR Cloud (pre-patch instances)

Discovery Timeline

2026-08-19 - CVE-2026-76366 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76366

Vulnerability Analysis

Splunk SOAR exposes a REST API that returns playbook run objects. The API supports filter parameters that let clients narrow results by matching field values. The API response layer normally hides sensitive fields such as session tokens from the returned payload. However, the filter layer does not enforce the same visibility rules and evaluates matches against hidden fields.

An authenticated user can iteratively guess characters of a hidden session token using filter comparisons. When the filter matches, the API returns the associated playbook run object, confirming the guess. This oracle behavior allows the attacker to reconstruct the complete token character by character without ever seeing it in a response body.

Once the attacker recovers a valid session token, they can impersonate the target user and access any data or perform any action within that user's authorization scope. Refer to the Splunk Security Advisory SVD-2026-0804 for vendor details.

Root Cause

The root cause is inconsistent enforcement of field-level access controls between the filter and response layers of the SOAR REST API. Filter predicates operate on the raw data model, while response serialization strips sensitive fields. This mismatch creates a side-channel that leaks values the response should hide.

Attack Vector

Exploitation requires network access to the SOAR REST API and valid low-privileged credentials. The attacker sends crafted GET requests to playbook run endpoints with filter parameters targeting hidden token fields. See the REST Run Playbook documentation for the affected endpoint surface.

The vulnerability requires no user interaction and can be automated to extract tokens across multiple user sessions. No verified public exploit is available at the time of publication.

Detection Methods for CVE-2026-76366

Indicators of Compromise

High volume of REST API requests to playbook run endpoints from a single authenticated user within a short time window
Repeated filter query parameters targeting authentication or session-related field names
API requests iterating through incremental character or substring filter values against hidden fields
Session token reuse from IP addresses or user agents inconsistent with the original login

Detection Strategies

Baseline normal REST API filter usage per user role and alert on statistical deviations in query volume or pattern complexity
Inspect API access logs for filter parameters referencing fields that should not be user-queryable, such as token or credential attributes
Correlate authentication events with subsequent playbook run API queries to identify credential harvesting behavior
Monitor for session tokens observed across multiple distinct client fingerprints or geolocations

Monitoring Recommendations

Forward Splunk SOAR audit logs and REST API access logs to a centralized SIEM for retention and correlation
Enable detailed API request logging including full query strings and filter parameters
Track per-user API request rate and alert on sustained anomalies above baseline
Review privileged account activity daily until all instances are patched

How to Mitigate CVE-2026-76366

Immediate Actions Required

Upgrade all Splunk SOAR deployments to version 8.6.0 or later without delay
Rotate all active session tokens and API keys after applying the patch to invalidate any previously exposed credentials
Audit recent REST API access logs for signs of filter-based enumeration against playbook run endpoints
Review and tighten SOAR user role assignments to minimize the blast radius of any compromised account

Patch Information

Splunk released the fix in Splunk SOAR version 8.6.0. Administrators should follow the upgrade guidance in Splunk Security Advisory SVD-2026-0804. No official workaround is published, so patching is the primary remediation path.

Workarounds

Restrict network access to the SOAR REST API to trusted management networks using firewall or reverse proxy rules
Enforce short session token lifetimes and require re-authentication on sensitive actions
Remove REST API access from user roles that do not require programmatic access to playbook runs
Monitor and rate-limit REST API filter queries at an upstream proxy until the patch is applied

bash

# Example: restrict SOAR REST API access at the reverse proxy
# nginx snippet to allow only trusted management subnet
location /rest/ {
    allow 10.0.10.0/24;
    deny all;
    limit_req zone=soar_api burst=20 nodelay;
    proxy_pass https://soar-backend;
}