CVE-2026-76366: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user can leverage REST API filtering on playbook runs to recover session tokens. This occurs because the REST API filtering mechanism does not prevent matching on values that are normally concealed in responses, leading to information disclosure. The exposed session tokens can compromise all data available to the affected user. The vulnerability is identified as CVE-2026-76366 with a CVSS 3.1 score of 6.5 (medium severity).

An authenticated user with a valid Splunk SOAR account can obtain session tokens through REST API filtering, potentially exposing all data accessible to that user. This results in information disclosure but does not affect integrity or availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 8.6.0, upgrading to version 8.6.0 or later may mitigate the issue if confirmed by the vendor. Until then, restrict access to trusted users and monitor for unusual API activity.