# CVE-2026-76406: Information Disclosure through REST API Authentication in Splunk SOAR

> CVE-2026-76406: Information Disclosure through REST API Authentication in Splunk SOAR. CVSS 5.9 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-76406
Last updated: 2026-10-22T16:57:10Z

- Published: 2026-10-21 22:52 UTC · Updated: 2026-10-22 16:57 UTC · Assigner: cisco
- CVSS: 5.9 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.32%, 25th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-203

## Description

In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data. The vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks. The attack requires the unauthenticated user to have encrypted credential data from an affected Splunk SOAR instance. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises) in the Splunk documentation.

## Affected vendors and products

- Splunk: Splunk SOAR

## Tracked companies

- [Splunk](https://rewindex.com/company/splunk.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-76406)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-76406)
- [https://advisory.splunk.com/advisories/SVD-2026-1010](https://advisory.splunk.com/advisories/SVD-2026-1010)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-76406 · Markdown: https://rewindex.com/cve/CVE-2026-76406.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-76406 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:14:22.655Z