CVE-2026-76369: Splunk SOAR Path Traversal Vulnerability

CVE-2026-76369 Overview

CVE-2026-76369 is a path traversal vulnerability [CWE-22] affecting Splunk SOAR versions below 8.6.0. An authenticated user holding the OnPrem Broker role can write files outside the intended Automation Broker log directory. The flaw exists because Automation Broker log uploads accept crafted filename input before writing log files to disk.

Exploitation requires high privileges and does not impact confidentiality or availability. The primary risk is limited integrity impact through arbitrary file writes within the SOAR instance filesystem context.

Critical Impact
An authenticated user with the OnPrem Broker role can write files outside the Automation Broker log directory by supplying crafted filenames during log uploads.

Affected Products

Splunk SOAR versions below 8.6.0
Splunk SOAR On-Premises deployments using the Automation Broker
Splunk SOAR Cloud tenants configured with OnPrem Broker role assignments

Discovery Timeline

2026-08-19 - CVE-2026-76369 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76369

Vulnerability Analysis

The vulnerability resides in the Splunk SOAR Automation Broker log upload handler. The handler receives filename input from the client and uses it to construct the destination path for the uploaded log file. Because the handler does not sanitize traversal sequences or validate that the resulting path stays within the intended log directory, an attacker can escape the base directory.

The result is a path traversal condition classified under [CWE-22]. An authenticated user with the OnPrem Broker role can direct writes to arbitrary filesystem locations that the SOAR service account can reach. The impact is bounded to integrity, since the flaw allows file creation or overwrite but does not directly leak data or crash the service.

Successful exploitation could allow an attacker to overwrite configuration files, drop scripts into paths that are later executed by scheduled tasks, or tamper with log data used for downstream analytics. The attacker must already possess valid credentials with the OnPrem Broker role, which limits practical exploitation to insider threats or scenarios where broker credentials have been compromised.

Root Cause

The root cause is insufficient input validation on the filename parameter accepted by the Automation Broker log upload endpoint. The service concatenates user-supplied filename input into the destination path without normalizing traversal sequences such as ../ or verifying that the canonical path resolves within the Automation Broker log directory.

Attack Vector

The attack vector is network-based and requires authentication as a user holding the OnPrem Broker role. The attacker submits a log upload request that includes a filename containing directory traversal sequences. The Automation Broker writes the file to the traversed path, resulting in arbitrary file write within the reach of the SOAR service account.

No verified public exploit code is available. For technical details, see the Splunk Security Advisory SVD-2026-0804.

Detection Methods for CVE-2026-76369

Indicators of Compromise

Log files or new files appearing outside the designated Automation Broker log directory on SOAR hosts
Automation Broker upload requests containing filename parameters with ../ sequences or absolute paths
Unexpected modifications to SOAR configuration files, playbook directories, or system paths writable by the SOAR service account
Broker role user sessions performing log upload actions from unusual source addresses

Detection Strategies

Review Automation Broker access logs for upload requests where the filename field contains traversal characters or unexpected path separators
Baseline the contents of the Automation Broker log directory and alert on file writes by the SOAR service account occurring outside that directory
Correlate OnPrem Broker role authentication events with subsequent filesystem changes on SOAR hosts

Monitoring Recommendations

Enable file integrity monitoring on SOAR configuration directories, playbook storage, and any system paths writable by the SOAR service user
Audit assignments of the OnPrem Broker role and alert on new grants of this role in Splunk SOAR
Forward Splunk SOAR audit logs to a centralized SIEM and build detections for anomalous Automation Broker upload activity

How to Mitigate CVE-2026-76369

Immediate Actions Required

Upgrade Splunk SOAR to version 8.6.0 or later, which contains the fix for the Automation Broker log upload path traversal
Inventory all accounts assigned the OnPrem Broker role and remove the assignment from any account that does not require it
Rotate credentials for accounts holding the OnPrem Broker role if any suspicious upload activity is identified

Patch Information

Splunk has addressed CVE-2026-76369 in Splunk SOAR version 8.6.0. Administrators should follow the upgrade guidance published in the Splunk Security Advisory SVD-2026-0804. Review the role and permission documentation referenced in the advisory to ensure only authorized users hold the OnPrem Broker role after the upgrade.

Workarounds

Restrict the OnPrem Broker role to a minimal set of trusted administrators until the patch is applied
Restrict network access to the Automation Broker endpoint to trusted management networks and broker hosts only
Increase auditing of Automation Broker log upload activity and file writes on SOAR hosts pending remediation

bash

# Configuration example
# Review users assigned the OnPrem Broker role in Splunk SOAR
# then remove the role from any account that does not require it via the SOAR web UI:
#   Administration > User Management > Roles > OnPrem Broker
# Confirm the deployed SOAR version is 8.6.0 or later:
cat /opt/phantom/etc/RELEASE