In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, specifically version 1.0, the product exposes the add-on OpenAPI specification through Splunk Web static file paths without requiring authentication. This exposure enables an unauthenticated actor to gather information about the REST API endpoints and authentication mechanisms, which could aid in further reconnaissance. The vulnerability exists because the OpenAPI specification is packaged as a static file served by Splunk Web without access restrictions. No official remediation or patch has been documented as of the publication date.

The vulnerability allows unauthenticated actors to access sensitive API specification information, potentially facilitating further reconnaissance or targeted attacks. However, it does not directly allow modification or disruption of the system, as the impact is limited to information disclosure (confidentiality impact only).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Splunk Web static file paths or implement network-level controls to limit unauthenticated access to the OpenAPI specification. Monitor vendor communications for updates on patches or official mitigations.