In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer (REST) API to… (CVE-2026-76370)

In Splunk SOAR versions prior to 8.6.0, an authenticated user with limited tenant access can exploit a flaw in the REST API to enumerate tenant names and identifiers beyond their authorized scope. The root cause is the lack of enforcement of role-based tenant restrictions in multi-tenant configurations when tenant information is returned through the REST API. This vulnerability is tracked as CVE-2026-76370 and is classified under CWE-863 (Incorrect Authorization).

The vulnerability allows unauthorized disclosure of tenant names and identifiers to authenticated users with restricted access. There is no indication of impact on data integrity or availability. The confidentiality impact is limited to tenant metadata exposure, which could aid an attacker in further reconnaissance or targeted attacks within a multi-tenant environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API to trusted users only and monitor for unusual access patterns. Review and enforce strict role-based access controls in multi-tenant deployments. Follow Splunk's documentation on REST roles and permissions and multi-tenant configuration best practices.