CVE-2026-76360 in SOAR
Summary
by MITRE • 08/19/2026
In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not verify that the caller holds a role permitted to view system health and cluster state. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Monitor the health of your Splunk SOAR (On-premises) system (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-system-health-and-performance/monitor-the-health-of-your-splunk-soar-on-premises-system) in the Splunk documentation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Splunk SOAR versions prior to 8.6.0 represents a critical failure in access control mechanisms, specifically categorized under CWE-285 Improper Authorization. This flaw allows authenticated users who have not been assigned any specific roles within the application to bypass security restrictions and access sensitive system telemetry data. The core technical issue lies in the /rest/health endpoint, which is designed to provide health metrics and cluster state information that should be strictly limited to administrative or support personnel with elevated privileges. Due to a missing authorization check during the request processing lifecycle, the server fails to validate whether the calling user possesses the necessary permissions before returning data. This oversight effectively treats all authenticated sessions equally regarding this specific endpoint, regardless of their assigned role hierarchy or permission set.
From an operational perspective, this vulnerability enables information disclosure that can significantly aid attackers in planning further malicious activities against the Splunk SOAR infrastructure. By accessing system and cluster telemetry, a low-privileged user can gather detailed insights into the internal architecture, server load, component status, and potential configuration weaknesses of the security orchestration platform. This intelligence is particularly dangerous because it allows adversaries to map out the environment without triggering alerts associated with high-level administrative actions. The exposure of such data aligns with ATT&CK technique T1082 System Information Discovery, where attackers collect information about the operating system, hardware, and software configurations to identify potential entry points or vulnerabilities for exploitation. In a Security Orchestration, Automation, and Response (SOAR) context, understanding the health and state of the platform is crucial for maintaining operational continuity, making this leak particularly sensitive as it reveals the resilience and current status of critical security operations tools.
The impact extends beyond mere data leakage to include potential reputational damage and increased risk of targeted attacks against the organization's security infrastructure. Since Splunk SOAR serves as a central hub for incident response activities, knowledge gained from these telemetry endpoints can help adversaries determine when the system is under stress or experiencing issues, potentially indicating periods of reduced monitoring effectiveness. Furthermore, this vulnerability highlights a broader issue in how default configurations and role assignments are handled within the application. Users who authenticate but lack explicit role assignments should be denied access to sensitive administrative functions by default, adhering to the principle of least privilege. The absence of such checks indicates that the authorization logic did not properly account for users with empty or null role attributes, treating them as having no restrictions rather than restricting all actions unless explicitly permitted.
To mitigate this vulnerability and prevent similar issues in future deployments, organizations running Splunk SOAR versions below 8.6.0 must immediately apply the vendor-provided patch that addresses this authorization gap. It is essential to verify that the update has been successfully deployed across all nodes in any clustered environment to ensure consistent security postures. Beyond applying patches, administrators should review their role and permission configurations to ensure that default user accounts or service accounts without specific roles are not inadvertently granted broad access rights through other mechanisms. Implementing strict input validation and enforcing mandatory authorization checks on all API endpoints, particularly those exposing system health data, is critical for maintaining a secure environment. Regular audits of authentication logs can help detect any unauthorized attempts to exploit this endpoint before it leads to more severe compromises. Maintaining up-to-date software versions remains the most effective defense against such known flaws in access control logic.