Unauthenticated API Vulnerability in Splunk SOAR Product

CVE-2026-76406

What is CVE-2026-76406?

In Splunk SOAR versions prior to 8.7.0, a vulnerability allows an unauthenticated user to leverage access to encrypted credential data. By submitting Basic authentication details to the REST API, these users can expose and decrypt sensitive credential information. The issue arises because the system decrypts Basic authentication values before completing necessary authentication checks. To exploit this vulnerability, the attacker must have access to encrypted credential data from an affected Splunk SOAR instance, but they cannot execute the attack freely.

References