---
id: "CVE-2026-76306"
kind: "vulnerability"
aliases: ["CVE-2026-76306"]
title: "Splunk SOAR: Observer role can infer other users' password hashes and tokens"
severity: "high"
cvss: 7.5
epss: 0.00222
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "rest-api", "self-hosted", "splunk-soar"]
not_affected_if: ["no-observer-users", "version-8.7.0-or-later"]
published_at: "2026-10-21T23:17:28+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:16:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76306", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76306", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk SOAR: Observer role can infer other users' password hashes and tokens

Splunk SOAR before 8.7.0 applies REST API query filters to user records before masking sensitive fields. A user with the Observer role can use those filters to infer other users' password hashes and authorization tokens.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Splunk SOAR version in the product's about or system information page; versions below `8.7.0` are affected.
- Review which accounts hold the Observer role in Splunk SOAR user management.

## Fix

- Upgrade Splunk SOAR on-premises to `8.7.0` or later.
- Rotate passwords and API tokens for users if Observer-role accounts may have queried user records before the upgrade (unknown whether the sources require this).

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76306
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76306

## From the sources

In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users.
The information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_