CVE-2026-76306: falha de alta gravidade em Splunk SOAR
Information Disclosure through REST API Query Filters in Splunk SOAR
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.2%
In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users.
The information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Splunk · Splunk SOARCVEs relacionadas — Splunk SOAR
No mesmo produto, das mais perigosas para as menos.
CVE-2026-76356HIGHAuthentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAREPSS 0.6%CVE-2026-76359MEDIUMPath Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAREPSS 0.5%CVE-2026-76358MEDIUMPath Traversal through App Installation Tar Extraction in Splunk SOAREPSS 0.5%CVE-2026-76357HIGHRemote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAREPSS 0.4%CVE-2026-76527CRITICALImproper Check or Handling of Exceptional Conditions in Splunk SOAREPSS 0.4%CVE-2026-76407CRITICALImproper Access Control in Splunk SOAREPSS 0.4%