CVE-2026-76530: The software defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization. in Splunk Splunk SOAR

This vulnerability arises because Splunk SOAR makes authorization decisions based on the assumption that URLs are canonical. If a non-canonical URL is used, it can bypass authorization checks, potentially allowing unauthorized access or actions. The issue is categorized under CWE-647 (Improper Neutralization of Path Elements). Cisco identified this during an internal security review and released a hardening update that addresses this and other vulnerabilities. The affected versions include all releases before 8.7.0.

The impact is that an attacker could bypass authorization controls by using non-canonical URL paths, potentially gaining unauthorized access or performing unauthorized actions within Splunk SOAR. There is no evidence of active exploitation in the wild. The vulnerability affects the integrity of authorization mechanisms.

A software hardening release from Cisco addresses this vulnerability. Users should upgrade to Splunk SOAR version 8.7.0 or later to remediate the issue. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the vendor advisory indicating the fix is included in version 8.7.0.