CVE-2026-76390 in Talos Intelligence for Enterprise Security Cloud
Summary
by MITRE • 08/20/2026
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 represents a significant information disclosure flaw rooted in improper access control mechanisms within the application's web interface architecture. Specifically, the OpenAPI specification file, which serves as a machine-readable description of the REST API endpoints and their associated parameters, was inadvertently packaged into a static file directory that is served by Splunk Web without requiring any form of authentication or authorization checks. This misconfiguration allows an unauthenticated actor to retrieve detailed technical documentation about the internal workings of the add-on simply by accessing specific URL paths designated for static content delivery.
From a technical perspective, this flaw falls under the category of improper access control where sensitive metadata is exposed through publicly accessible endpoints. The OpenAPI specification provides a comprehensive map of all available API operations, including their input parameters, expected responses, and authentication requirements. By exposing this file to unauthenticated users, attackers gain valuable intelligence regarding the attack surface of the application. This includes identifying specific REST endpoints that may be vulnerable to injection attacks or other exploitation techniques, as well as understanding the authentication model used by the service, which can aid in crafting more targeted phishing or credential stuffing campaigns if additional weaknesses are present elsewhere in the system.
The operational impact of this vulnerability is primarily centered on reconnaissance and information gathering rather than direct code execution or data exfiltration at this stage. However, such exposure significantly lowers the barrier for subsequent attacks by providing adversaries with a blueprint of the application's API structure. This aligns closely with Common Weakness Enumeration (CWE) identifier CWE-200, which defines Information Exposure through an error message that reveals internal implementation details or configuration data. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates the Reconnaissance phase, specifically supporting techniques such as Active Scanning where adversaries probe systems to discover services and vulnerabilities, thereby enabling more efficient exploitation attempts against other components of the Splunk Enterprise Security environment.
To mitigate this risk, administrators must ensure that all OpenAPI specifications and similar metadata files are not served through public-facing static file paths without authentication. The recommended remediation is to upgrade Cisco Talos Intelligence for Enterprise Security Cloud to version 1.0.3 or later, where this access control issue has been addressed by restricting access to these sensitive resources. Additionally, organizations should implement web application firewalls that can detect and block requests attempting to retrieve API documentation from unauthorized sources, ensuring that only authenticated users with appropriate privileges can view such technical specifications. Regular auditing of static file serving configurations is also advised to prevent similar misconfigurations in other add-ons or integrated services within the Splunk ecosystem.