CVE-2026-76368 Overview
CVE-2026-76368 is a missing authorization vulnerability in Splunk SOAR versions below 8.6.0. A user assigned a role containing the playbooks:view permission can retrieve metadata about a playbook repository they are not authorized to view. The issue exists because the Playbook History feature does not check repository permissions before returning playbook revision metadata. The weakness is classified as [CWE-862] Missing Authorization.
Critical Impact
Authenticated Splunk SOAR users with playbooks:view can view metadata about playbook repositories outside their authorization scope, resulting in limited confidentiality impact.
Affected Products
- Splunk SOAR versions below 8.6.0
- Splunk SOAR (On-Premises) deployments prior to the fixed release
- Splunk SOAR (Cloud) instances running affected versions
Discovery Timeline
- 2026-08-19 - CVE-2026-76368 published to the National Vulnerability Database
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76368
Vulnerability Analysis
The vulnerability resides in the Playbook History component of Splunk SOAR. When a user with the playbooks:view permission queries playbook revision metadata, the backend returns results without validating whether the caller has permission to access the underlying playbook repository. This behavior enables cross-repository metadata disclosure limited to authenticated users.
The exposed data is metadata about playbook revisions rather than playbook content or credentials. The impact is limited to confidentiality; the flaw does not permit modification of playbooks or disruption of SOAR operations. The vulnerability requires an authenticated session with elevated privileges, which reduces the population of viable attackers.
Root Cause
The root cause is a missing authorization check [CWE-862]. Playbook History enforces the playbooks:view permission but omits the secondary check that validates repository-level access. Splunk's role and repository permission model is documented in the Splunk SOAR administration guides, and the fix restores enforcement of repository-scoped authorization before returning metadata.
Attack Vector
An attacker must first obtain valid credentials for a Splunk SOAR account that holds a role granting playbooks:view. Once authenticated, the attacker queries the Playbook History interface or its underlying API to enumerate metadata for playbook revisions across repositories, including those the user should not access. No user interaction is required beyond the attacker's own actions. The attack is conducted over the network against the SOAR web interface.
No public proof-of-concept exploit or in-the-wild exploitation has been reported. Refer to the Splunk Security Advisory SVD-2026-0804 for vendor technical details.
Detection Methods for CVE-2026-76368
Indicators of Compromise
- Unexpected access to Playbook History endpoints by user accounts that do not typically interact with playbook repositories.
- Enumeration patterns showing sequential requests for playbook revision metadata across multiple repository identifiers.
- Audit log entries showing playbooks:view role holders accessing metadata for repositories outside their assigned scope.
Detection Strategies
- Review Splunk SOAR audit logs for Playbook History API calls and correlate the requesting user with their assigned repository permissions.
- Baseline normal Playbook History usage per user and alert on deviations such as broad repository enumeration.
- Monitor for privilege drift where roles are modified to include playbooks:view without a corresponding business justification.
Monitoring Recommendations
- Forward Splunk SOAR audit and access logs to a centralized SIEM for long-term retention and correlation.
- Track role and permission changes on Splunk SOAR accounts and alert on additions of the playbooks:view permission.
- Alert on any successful metadata retrieval calls originating from service accounts or non-interactive sessions.
How to Mitigate CVE-2026-76368
Immediate Actions Required
- Upgrade Splunk SOAR to version 8.6.0 or later, which addresses the missing repository authorization check.
- Audit all roles that grant the playbooks:view permission and remove it from accounts that do not require it.
- Review Playbook History access logs for signs of prior cross-repository metadata enumeration.
Patch Information
Splunk has released a fix in Splunk SOAR version 8.6.0. Administrators should follow the upgrade guidance in Splunk Security Advisory SVD-2026-0804. Splunk SOAR (Cloud) customers should confirm their tenant has been updated by Splunk.
Workarounds
- Restrict membership in roles that carry the playbooks:view permission until the upgrade is applied.
- Enforce the principle of least privilege by aligning role assignments with the repository access documented in the Splunk SOAR administration guides.
- Increase monitoring of Playbook History access patterns for accounts that retain playbooks:view prior to patching.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
