Information Disclosure in Splunk SOAR Affecting User Passwords and Tokens

CVE-2026-76306

What is CVE-2026-76306?

In versions of Splunk SOAR prior to 8.7.0, users assigned the 'Observer' role can exploit query filters within the REST API to gain unauthorized access to password hashes and authorization tokens belonging to other users. This vulnerability arises because the application's filtering mechanism for REST API queries does not adequately protect sensitive fields, allowing for potential information leakage. It is crucial for organizations using affected versions to update to mitigate this risk and protect sensitive user data.

References