---
id: "CVE-2026-76406"
kind: "vulnerability"
aliases: ["CVE-2026-76406"]
title: "Splunk SOAR: unauthenticated REST API call decrypts stored credential data"
severity: "medium"
cvss: 5.9
epss: 0.00321
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "security-operations", "self-hosted", "splunk-soar"]
not_affected_if: ["managed-hosting", "version-8.7.0-or-later"]
published_at: "2026-10-21T23:17:29+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:08:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76406", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76406", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk SOAR: unauthenticated REST API call decrypts stored credential data

Splunk SOAR below 8.7.0 decrypts encrypted Basic authentication values before it checks authentication, so the REST API can be abused to decrypt stored credentials. An attacker who already holds encrypted credential data from an affected instance can submit it to the API without an account and recover the plaintext.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Splunk SOAR version in the product's admin interface or on the host, and compare it with `8.7.0`.
- Confirm whether the REST API is reachable from networks outside the SOAR operators' trusted network.

## Fix

- Upgrade Splunk SOAR on-premises to `8.7.0` or later.
- Rotate credentials stored in Splunk SOAR if an affected instance was exposed to untrusted callers.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76406
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76406

## From the sources

In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data.
The vulnerability is possible because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks.
The attack requires the unauthenticated user to have encrypted credential data from an affected Splunk SOAR instance. The unauthenticated user should not be able to exploit the vulnerability at will.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises) in the Splunk documentation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_