In Splunk SOAR versions prior to 8.6.0, the connectivity check REST API endpoint (/rest/support/connectivity/.../check_connectivity) can be abused by an Administrator user to cause the server to make outbound network connections to arbitrary destinations. This is due to insufficient validation of the requested destination URL, enabling Server-Side Request Forgery (SSRF). The vulnerability allows the attacker to determine whether internal hosts and ports are reachable by leveraging the server's network access. The CVSS 3.1 base score is 2.7, reflecting low impact primarily on confidentiality with no impact on integrity or availability. No official patch or remediation guidance is provided in the available data.

An attacker with Administrator privileges can exploit this SSRF vulnerability to make Splunk SOAR initiate outbound network connections to arbitrary hosts and ports. This could be used to probe internal network resources for reachability, potentially aiding in further network reconnaissance. The impact on confidentiality is low, with no direct impact on integrity or availability reported. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator role assignments to trusted users only to reduce risk. Monitor for unusual use of the /rest/support/connectivity/.../check_connectivity endpoint. Follow Splunk's documentation on managing roles and permissions to limit exposure.