Cpe:2.3:a:splunk:soar:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asplunksoar/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 23:49:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSplunk SOAR: Authentication token inference and privilege escalation (CVE-2026-76307)https://feed.craftedsignal.io/briefs/2026-10-splunk-soar-auth-bypass/Wed, 21 Oct 2026 23:49:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-splunk-soar-auth-bypass/Splunk SOAR versions prior to 8.7.0 are vulnerable to an authentication bypass where a user with restricted permissions can use the REST API to infer administrative tokens via crafted query filters.Splunk SOAR versions below 8.7.0 contain an authentication vulnerability (CVE-2026-76307) that allows a user with "Users and Roles" view permissions to infer authentication tokens belonging to other users. The vulnerability arises because the REST API permits caller-controlled query filters on sensitive user record fields. By targeting these fields, a standard user can obtain tokens and potentially escalate privileges to administrative levels.

Impact

Successful exploitation allows a non-privileged user with specific view permissions to obtain administrative authentication tokens, leading to full unauthorized control over the Splunk SOAR instance.

Recommendation

  • Upgrade Splunk SOAR to version 8.7.0 or later immediately.
  • Review existing role-based access control (RBAC) configurations in Splunk SOAR to ensure that "Users and Roles" view permissions are granted only to strictly authorized personnel.
  • Audit REST API logs for anomalous query patterns targeting sensitive user record fields or repetitive filter attempts.
]]>highadvisoryprivilege-escalationsplunksoarcve-2026-76307