In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on… (CVE-2026-76366)

CVE-2026-76366 affects Splunk SOAR versions prior to 8.6.0. It allows an authenticated user to leverage REST API filtering on playbook runs to extract session tokens. The root cause is that the REST API filtering mechanism does not prevent matching on values that responses normally conceal, resulting in unintended information disclosure. This flaw is classified under CWE-200 (Information Exposure). No known exploits in the wild have been reported. The vulnerability impacts confidentiality but does not affect integrity or availability.

An attacker with a valid Splunk SOAR account can recover session tokens belonging to other sessions via the REST API filtering feature. These tokens could allow the attacker to access all data available to the compromised user account. The vulnerability does not affect system integrity or availability but poses a significant confidentiality risk for user data within the affected environment.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API to trusted users only and monitor for unusual API usage patterns related to playbook runs. Follow Splunk's official documentation and advisories for updates on remediation.