Authentication Token Exposure in Splunk SOAR by Splunk

CVE-2026-76307

What is CVE-2026-76307?

In versions prior to 8.7.0 of Splunk SOAR, a vulnerability exists that allows users with the Users and Roles view permission to exploit the REST API. By manipulating caller-controlled query filters, these users can infer authentication tokens for other users. If a compromised token provides administrative access, it could allow unauthorized users to gain admin privileges within the Splunk SOAR environment, posing a severe security risk.

References