CVE-2026-76304 Splunk CVE debrief

Who should care

Splunk SOAR administrators, security teams, and users with access to Automation Broker configuration files should assess exposure and verify patching to prevent potential information disclosure.

Why it matters

CVE-2026-76304 is a medium severity vulnerability in Splunk SOAR that allows authenticated users to download sensitive configuration files. Defenders should assess exposure, verify patching, and restrict access to prevent potential information disclosure.

• Potential exposure of sensitive information: instance URL, container image location, and Automation Broker version.
• Verification priority: Check if affected versions are in use and if patching has been applied.
• Defensive consequence: Restrict access to Automation Broker configuration files to prevent unauthorized access.

Technical summary

CVE-2026-76304 is a medium severity vulnerability in Splunk SOAR versions below 8.7.0. An authenticated user without edit permissions can download the Automation Broker Docker Compose configuration file, exposing sensitive information such as instance URL, container image location, and Automation Broker version. This vulnerability is possible because Splunk SOAR returns the configuration file without enforcing the Automation Broker edit permission. Defenders should assess exposure, verify patching, and restrict access to prevent potential information disclosure.

Defensive priority

Medium priority for Splunk SOAR administrators and security teams to assess exposure and verify patching.

Recommended defensive actions

• Assess exposure: Verify if Splunk SOAR versions below 8.7.0 are in use.
• Verify patching: Check if affected systems have been upgraded to version 8.7.0 or later.
• Restrict access: Limit access to Automation Broker configuration files.
• Monitor for suspicious activity: Review logs for unauthorized access to configuration files.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from official CVE Program record, NIST NVD vulnerability detail, and Splunk advisory. Limited details on exploitation or victim impact. The CVE record was published on 2026-10-21T22:52:05.722Z and has not been modified since then. No additional information on exploitation or affected systems has been provided. Defenders should verify patching and restrict access to Automation Broker configuration files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.