CVE-2026-76366— Information Disclosure through the REST API in Splunk SOAR
Quick assessment
Affected
Splunk Splunk SOAR
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Splunk SOAR 8.6.0 之前的版本中，拥有有效 Splunk SOAR 账户的用户可以利用表示状态转移（REST）API 的过滤功能，从剧本运行结果中恢复会话令牌，从而获取该受影响用户有权访问的所有数据。由于 Splunk SOAR 未阻止 REST API 过滤器匹配那些在其他情况下会被隐藏响应的值，因此可能导致信息泄露。更多详情请参阅 Splunk 文档中的“REST 运行剧本”页面：https://help.splunk.com/en/splunk-soar/soar-cloud/rest-a
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Splunk | Splunk SOAR | 8.6< 8.6.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76366
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure through the REST API in Splunk SOAR
Source: CVE Program / CVE List V5
Vulnerability Description
In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR does not block REST API filters from matching values that responses otherwise hide. For more information see REST Run Playbook (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/run-playbook-endpoints/rest-run-playbook) in the Splunk documentation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Splunk | Splunk SOAR | 8.6 ~ 8.6.0 | - |
|
II. Public POCs for CVE-2026-76366
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76366
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76366 (1)
Same Patch Batch · Splunk · 2026-08-19 · 110 CVEs total
| CVE-2026-76312 | 9.4 CRITICAL | Improper Access Control through Embedded Reports in Splunk Enterprise |
| CVE-2026-76310 | 9.4 CRITICAL | Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise |
| CVE-2026-76311 | 9.4 CRITICAL | Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise |
| CVE-2026-76404 | 9.1 CRITICAL | Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server |
| CVE-2026-76395 | 8.8 HIGH | Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading |
| CVE-2026-76316 | 8.8 HIGH | Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise |
| CVE-2026-76351 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secu |
| CVE-2026-76350 | 8.8 HIGH | Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk En |
| CVE-2026-76389 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for En |
| CVE-2026-76253 | 8.8 HIGH | Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterpr |
| CVE-2026-76315 | 8.8 HIGH | Code Injection through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76319 | 8.8 HIGH | Remote Code Execution (RCE) through Federated Search in Splunk Enterprise |
| CVE-2026-76313 | 8.8 HIGH | Remote Code Execution (RCE) through the REST API in Splunk Enterprise |
| CVE-2026-76259 | 8.8 HIGH | Improper Privilege Management on the Management Port in Splunk Enterprise for Windows |
| CVE-2026-76335 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76317 | 8.8 HIGH | Path Traversal through the Lookup Configuration REST API in Splunk Enterprise |
| CVE-2026-76314 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76352 | 8.8 HIGH | Improper Authorization through the REST API in Splunk Enterprise |
| CVE-2026-76394 | 8.3 HIGH | Missing Authorization in Container and Connection Management through the REST API in Splun |
| CVE-2026-76391 | 8.3 HIGH | Improper Privilege Management through Agent Run History in Splunk AI Toolkit |
Showing top 20 of 110 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Splunk SOAR
-
CVE-2026-76370
Information Disclosure through the REST API in Splunk SOAR -
CVE-2026-76369
Path Traversal through Automation Broker in Splunk SOAR -
CVE-2026-76368
Missing Authorization through Playbooks in Splunk SOAR -
CVE-2026-76367
Stored Cross-Site Scripting (XSS) through Notes in Splunk SO -
CVE-2026-76365
Structured Query Language (SQL) Injection through Custom Lis
Same vendor: Splunk
-
CVE-2026-76405
Information Disclosure through Cleartext Storage in the App -
CVE-2026-76403
Improper Certificate Validation through HTTP Event Collector -
CVE-2026-76404
Remote Code Execution (RCE) through Deserialization of Untru -
CVE-2026-76401
Regular Expression Denial of Service (DoS) through the REST -
CVE-2026-76402
Server-Side Request Forgery (SSRF) through the REST API in S
Same weakness: CWE-200
-
CVE-2026-55553
urllib: Cross-origin redirects preserve credential-bearing r -
CVE-2026-79780
rclone before v1.75.0 Credential Exposure via S3 Redirect -
CVE-2026-79776
rclone before 1.75.0 Authentication Bypass via pprof -
CVE-2026-79660
Ech0 before 4.7.3 Email Disclosure via Public API -
CVE-2026-21758
HCL Hive is affected by multiple security vulnerabilities.
V. Comments for CVE-2026-76366
No comments yet