Missing Authorization in Splunk SOAR Allows Unrestricted Access

CVE-2026-76360

What is CVE-2026-76360?

In certain versions of Splunk SOAR, an authenticated user who does not possess any assigned role can exploit the /rest/health endpoint. This flaw permits unauthorized access to critical system metrics that should be restricted to administrative personnel. The absence of necessary authorization checks means that sensitive telemetry data can potentially be exposed, putting the system's integrity at risk. For more details, refer to the Splunk documentation on managing roles and monitoring system health.

References