# CVE-2026-76366: Information Disclosure through the REST API in Splunk SOAR

> CVE-2026-76366: Information Disclosure through the REST API in Splunk SOAR. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76366
Last updated: 2026-08-21T14:54:44Z

- Published: 2026-08-19 21:34 UTC · Updated: 2026-08-21 14:54 UTC · Assigner: cisco
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.39%, 32th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-200

## Description

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer (REST) API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR does not block REST API filters from matching values that responses otherwise hide. For more information see REST Run Playbook (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/run-playbook-endpoints/rest-run-playbook) in the Splunk documentation.

## Affected vendors and products

- Splunk: Splunk SOAR

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76366)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76366)
- [https://advisory.splunk.com/advisories/SVD-2026-0804](https://advisory.splunk.com/advisories/SVD-2026-0804)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76366 · Markdown: https://rewindex.com/cve/CVE-2026-76366.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76366 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T01:58:51.182Z