Vulnerability Description
In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The Server-Side Request Forgery (SSRF) is possible because the connectivity check REST API does not sufficiently validate the destination before Splunk SOAR connects to it. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Soar | < 8.6.0 |
Related Weaknesses (CWE)
References
- https://advisory.splunk.com/advisories/SVD-2026-0804Vendor Advisory
FAQ
What is CVE-2026-76361?
CVE-2026-76361 is a vulnerability with a CVSS score of 2.7 (LOW). In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connect...
How severe is CVE-2026-76361?
CVE-2026-76361 has been rated LOW with a CVSS base score of 2.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-76361?
Check the references section above for vendor advisories and patch information. Affected products include: Splunk Soar.