{"id":"CVE-2026-76406","kind":"vulnerability","aliases":["CVE-2026-76406"],"related":[],"title":"Splunk SOAR: unauthenticated REST API call decrypts stored credential data","description":"In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data.\nThe vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks.\nThe attack requires the unauthenticated user to have encrypted credential data from an affected Splunk SOAR instance. The unauthenticated user should not be able to exploit the vulnerability at will.\nFor more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises) in the Splunk documentation.","summary":"Splunk SOAR below 8.7.0 decrypts encrypted Basic authentication values before it checks authentication, so the REST API can be abused to decrypt stored credentials. An attacker who already holds encrypted credential data from an affected instance can submit it to the API without an account and recover the plaintext.","severity":"medium","cvss":5.9,"epss":0.00321,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","security-operations","self-hosted","splunk-soar"],"not_affected_if":["managed-hosting","version-8.7.0-or-later"],"how_to_check":"- Check the installed Splunk SOAR version in the product's admin interface or on the host, and compare it with `8.7.0`.\n- Confirm whether the REST API is reachable from networks outside the SOAR operators' trusted network.","fix":"- Upgrade Splunk SOAR on-premises to `8.7.0` or later.\n- Rotate credentials stored in Splunk SOAR if an affected instance was exposed to untrusted callers.","status":"open","published_at":"2026-10-21T23:17:29+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:08:02+00:00","updated_at":"2026-10-25T04:08:02+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:08:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk SOAR on-premises to `8.7.0` or later.\n- Rotate credentials stored in Splunk SOAR if an affected instance was exposed to untrusted callers.","reach":"network","title":"Splunk SOAR: unauthenticated REST API call decrypts stored credential data","impact":"medium","summary":"Splunk SOAR below 8.7.0 decrypts encrypted Basic authentication values before it checks authentication, so the REST API can be abused to decrypt stored credentials. An attacker who already holds encrypted credential data from an affected instance can submit it to the API without an account and recover the plaintext.","category":"other","nicknames":[],"who_cares":["splunk-soar","self-hosted","security-operations"],"confidence":0.6,"needs_auth":"no","worst_case":"Stored credentials are decrypted and exposed to an unauthenticated caller.","analyst_note":"Check the Splunk advisory for the exact affected version range and the REST API endpoint behaviour before relying on the version-based check.","how_to_check":"- Check the installed Splunk SOAR version in the product's admin interface or on the host, and compare it with `8.7.0`.\n- Confirm whether the REST API is reachable from networks outside the SOAR operators' trusted network.","needs_analyst":true,"not_affected_if":["version-8.7.0-or-later","managed-hosting"],"who_is_affected":"Operators of on-premises Splunk SOAR instances running versions below 8.7.0 whose REST API is reachable by untrusted users. Exploitation requires the attacker to already hold encrypted credential data from an affected instance, so the risk is limited to that exposure. Managed or already-upgraded instances can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":3581,"output_tokens":636,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-76406':13A,16A '/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises)':180C '8.7.0':30B,81C 'abl':156C 'abus':46B 'access':86C 'account':71B 'affect':61B,93C,146C 'alreadi':54B 'api':5A,43B,68B,108C,170C 'attack':52B,134C 'authent':34B,39B,100C,127C,131C 'basic':33B,99C,126C 'call':6A 'check':38B,132C 'complet':130C 'could':97C 'credenti':9A,50B,57B,89C,115C,142C 'cve':11A,14A 'data':10A,58B,90C,101C,116C,143C 'decrypt':7A,31B,48B,112C,124C 'document':184C 'encrypt':32B,56B,88C,114C,125C,141C 'exploit':158C 'expos':110C 'help.splunk.com':179C 'help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises)':178C 'hold':55B 'host':23B 'inform':165C 'instanc':62B,96C,149C 'on-premis':175C 'oper':20B 'plaintext':75B 'possibl':120C 'premis':177C 'recov':73B 'refer':171C 'represent':104C 'requir':135C 'rest':4A,42B,107C,169C 'secur':19B 'security-oper':18B 'see':166C 'self':22B 'self-host':21B 'soar':2A,26B,28B,78C,95C,123C,148C,174C 'splunk':1A,25B,27B,77C,94C,122C,147C,173C,183C 'splunk-soar':24B 'state':105C 'store':8A,49B 'submit':64B,98C 'transfer':106C 'unauthent':3A,83C,137C,151C 'use':167C 'user':84C,138C,152C 'valu':35B,128C 'version':79C 'vulner':118C,160C 'without':69B","nicknames":[],"mitigations":[],"who_affected":"Operators of on-premises Splunk SOAR instances running versions below 8.7.0 whose REST API is reachable by untrusted users. Exploitation requires the attacker to already hold encrypted credential data from an affected instance, so the risk is limited to that exposure. Managed or already-upgraded instances can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76406","severity":null,"published_at":"2026-10-21T23:17:29+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76406","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76406","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}