CVE-2026-76356

This is a trust boundary failure disguised as an IP spoofing vulnerability. The Splunk SOAR Automation Broker accepted a client-supplied IP header (X-Forwarded-For) as proof of local origin—meaning any attacker could impersonate the loopback interface by simply setting that header to 127.0.0.1. This isn't a subtle race condition or cryptographic weakness; it's an application layer treating what is trivially forgeable as trustworthy. The CVSS 8.1 rating likely overstates exploitability in typical deployments while underselling the architectural failure. The EPSS score of 0.00362 likely reflects deployment topology: if the Automation Broker typically sits on an isolated management network rather than being directly internet-facing, the actual attack surface is narrower than the CVSS vector implies. That said, limited wild exploitation doesn't mean limited damage potential. What makes this worse than a typical RCE: Splunk SOAR is a security orchestration platform. It holds credentials, API tokens, and orchestration access to identity providers, EDR tools, SIEMs, ticketing systems, and network devices. Compromising the Broker doesn't just give you code execution—it gives you a beachhead inside a system designed to have broad reach into your security infrastructure. The patch closes the spoofing vector. It doesn't rotate the service account credentials SOAR uses, invalidate stored API keys, or revoke integrations that were trusted to run from the Broker's host. If you were compromised before patching, the attacker still has those credentials. Verify whether Splunk's documentation for affected versions explicitly required network isolation for the Automation Broker, or whether it treated localhost trust as an implicit assumption. If the latter, this wasn't just a coding error—it was a design assumption baked into the product that failed in any environment with broader network access. Assume the documentation gap exists and treat the Broker as a high-value target regardless of network placement.

Reviewed through automated stages and approved by a human before publication.