CVE-2026-76361: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.6.0, the connectivity check REST API endpoint does not properly validate the destination URL before initiating outbound connections. This allows a user with Administrator privileges to perform SSRF attacks by causing the server to connect to arbitrary network locations. The vulnerability enables network reconnaissance by determining if internal hosts and ports are reachable, but does not allow data exfiltration or code execution.

The impact is limited to information disclosure about network reachability of internal hosts and ports. There is no direct compromise of data confidentiality, integrity, or availability. The CVSS score is 2.7 (low), reflecting the limited scope and required high privileges (Administrator role) to exploit.

A fix is available in Splunk SOAR version 8.6.0 and later. Users should upgrade to version 8.6.0 or newer to remediate this vulnerability. Since this is an on-premises product, administrators must apply the update manually. No additional mitigation steps are indicated in the vendor documentation.