CVEvulnerability
CVE-2026-76356
8.1 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-08-19
- Last modified
- 2026-08-27
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-290
Description
In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that the request originates from the local system. Successful exploitation can expose all relevant data, affect system integrity, and disrupt service availability. For more information see About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.
Affected configurations
• splunk soar (< 8.6.0)
Related
Weakness · CWE (1)
- CWE-290 Authentication Bypass by Spoofing weakness
References
- https://advisory.splunk.com/advisories/SVD-2026-0804 Vendor Advisory