[ CVE-2026-76406 · Published 21 Oct 2026 ]
Vulnerability in Splunk SOAR
[ Description ]Official description
In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data. The vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks. The attack requires the unauthenticated user to have encrypted credential data from an affected Splunk SOAR instance. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises) in the Splunk documentation.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1366
Multiple vulnerabilities in Splunk products Translated from French
Multiple vulnerabilities have been discovered in Splunk products. Some of them allow an attacker to cause arbitrary code execution, a breach of data confidentiality and remote cross-site scripting (XSS).
-
BSI CERT-BundWID-SEC-2026-4099
Splunk SOAR: Multiple vulnerabilities Translated from German