CVE-2026-76389: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. in Splunk Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions >=1.0 and <1.0.3, the Talos intelligence enrichment REST API endpoint does not sufficiently validate the destination of outbound requests triggered by authenticated Splunk management requests. A user with the get_talos_enrichment capability can craft requests that cause the system to send outbound requests to attacker-controlled servers, potentially exposing sensitive tokens and compromising data confidentiality, integrity, and availability within the Splunk instance.

Successful exploitation can lead to disclosure of sensitive tokens, resulting in compromise of all relevant data and system integrity within the affected Splunk instance. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS score of 8.8 with high impact on all three security properties.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the get_talos_enrichment capability to trusted users only and monitor for suspicious activity involving the Talos intelligence enrichment REST API endpoint.