CVE-2026-76370: Splunk SOAR Information Disclosure Flaw

CVE-2026-76370 Overview

CVE-2026-76370 is an authorization flaw in Splunk SOAR versions below 8.6.0. An authenticated user with restricted tenant access can query the Representational State Transfer (REST) API to view names and identifiers of tenants outside their assigned role scope. The issue affects deployments with multi-tenancy enabled. Splunk SOAR fails to enforce role-based tenant restrictions when returning tenant metadata through the REST API. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated low-privilege users can enumerate tenant names and identifiers across the multi-tenant deployment, exposing organizational structure and enabling reconnaissance for follow-on attacks.

Affected Products

Splunk SOAR (On-premises) versions below 8.6.0
Splunk SOAR Cloud deployments with multi-tenancy enabled
Splunk SOAR REST API role management endpoints

Discovery Timeline

2026-08-19 - CVE-2026-76370 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76370

Vulnerability Analysis

The vulnerability resides in Splunk SOAR's REST API layer that handles tenant information requests. In multi-tenant deployments, administrators assign users to specific tenants through role-based access control. The API endpoints that return tenant listings do not apply these role-scope filters before returning results. An authenticated user who queries tenant endpoints receives records for tenants they should not be able to see.

The disclosed data includes tenant names and internal identifiers. While the flaw does not permit modification of tenant data or unauthorized access to tenant contents, the exposed identifiers can support targeted enumeration and reconnaissance. Splunk addresses the flaw in Splunk SOAR 8.6.0 by enforcing role-based tenant filtering on the affected REST endpoints.

Root Cause

The root cause is missing authorization enforcement on tenant-listing REST API responses. The application authenticates the caller but does not verify that returned tenant records fall within the caller's role scope. This is a classic [CWE-863] incorrect authorization pattern where access decisions are inconsistent between the user interface and the API layer.

Attack Vector

Exploitation requires an authenticated account with any level of tenant access on a multi-tenant Splunk SOAR deployment. The attacker issues an HTTP request to the tenant REST endpoint and parses the response for tenant names and identifiers outside their assigned scope. No user interaction and no elevated privileges are required. The attack is fully network-based against the SOAR management interface.

See the Splunk Security Advisory SVD-2026-0804 for vendor technical details.

Detection Methods for CVE-2026-76370

Indicators of Compromise

Unexpected authenticated requests to Splunk SOAR REST tenant management endpoints originating from low-privileged accounts
API access patterns showing enumeration of tenant identifiers by users assigned to a single tenant scope
REST API responses returning tenant records that exceed the caller's known role assignments in audit logs

Detection Strategies

Review Splunk SOAR audit logs for REST API calls to tenant role management endpoints made by non-administrative accounts
Correlate authenticated session identifiers with role scope to identify users querying tenant metadata outside their assignments
Baseline normal REST API tenant query volume per role and alert on deviations

Monitoring Recommendations

Enable verbose REST API logging on Splunk SOAR instances running versions below 8.6.0 until patching is complete
Forward SOAR access logs to a centralized SIEM for correlation with user role assignments
Alert on any tenant-listing API responses that return more records than the caller's assigned tenant count

How to Mitigate CVE-2026-76370

Immediate Actions Required

Upgrade Splunk SOAR to version 8.6.0 or later, which enforces role-based tenant filtering on the REST API
Audit existing user accounts with restricted tenant access and review recent REST API activity for signs of tenant enumeration
Rotate API tokens for accounts that may have been used to enumerate tenant metadata

Patch Information

Splunk has released a fix in Splunk SOAR 8.6.0. Refer to the Splunk Security Advisory SVD-2026-0804 for upgrade guidance and complete affected version details.

Workarounds

Restrict network access to the Splunk SOAR REST API to trusted management networks only
Limit multi-tenancy usage to trusted administrative users until the patch is applied
Reduce the number of accounts with authenticated access to multi-tenant SOAR deployments as an interim control

bash

# Verify installed Splunk SOAR version
phenv --version

# Confirm the deployment is running 8.6.0 or later after upgrade
curl -k -u <admin>:<password> \
  https://<soar-host>/rest/system_info | grep version