← Vulnerability feed

Vulnerability record · CVE-2026-76370 · published 19 August 2026

CVE-2026-76370: Splunk soar incorrect authorization vulnerability

Splunk · Soar

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer (REST) API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not enforce role-based tenant restrictions when it returns tenant information through the REST API in deployments with multi-tenancy turned on. For more information see REST Roles and Permissions (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/role-management-endpoints/rest-roles-and-permissions) and Configure multiple tenants on your Splunk SOAR (On-premises) instance (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/configure-product-settings-for-your-splunk-soar-on-premises-instance/configure-multiple-tenants-on-your-splunk-soar-on-premises-instance) in the Splunk documentation.

4.3 CVSS 3.1 Medium EPSS 0.27% · top 82.7% CWE-863 · Incorrect authorization
4.3CVSS 3.1 base score
0.27%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
21 Aug 2026Last modified by NVD

Description

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer (REST) API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not enforce role-based tenant restrictions when it returns tenant information through the REST API in deployments with multi-tenancy turned on. For more information see REST Roles and Permissions (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/role-management-endpoints/rest-roles-and-permissions) and Configure multiple tenants on your Splunk SOAR (On-premises) instance (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/configure-product-settings-for-your-splunk-soar-on-premises-instance/configure-multiple-tenants-on-your-splunk-soar-on-premises-instance) in the Splunk documentation.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://advisory.splunk.com/advisories/SVD-2026-0804 Vendor Advisory

Track CVE-2026-76370 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.1CVE-2026-76356Splunk soar authentication bypass by spoofing vulnerabilityIn Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notificat…EPSS 0.61%7.8CVE-2023-3997Splunk soar vulnerabilitySplunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can se…EPSS 0.29%7.6CVE-2026-76357Splunk soar path traversal vulnerabilityIn Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Trans…EPSS 0.43%7.4CVE-2026-76362Splunk soar improper certificate validation vulnerabilityIn Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk R…EPSS 0.21%6.5CVE-2026-76366Splunk soar information exposure vulnerabilityIn Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbo…EPSS 0.39%6.5CVE-2026-76358Splunk soar path traversal vulnerabilityIn Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the i…EPSS 0.52%6.5CVE-2026-76359Splunk soar path traversal vulnerabilityIn Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive …EPSS 0.52%6.5CVE-2026-76363Splunk soar vulnerabilityIn Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language (SQL) statements a…EPSS 0.41%

Source: NIST National Vulnerability Database (record CVE-2026-76370), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.