CVE-2026-76357

This CVE exposes a dangerous gap in Splunk SOAR's authorization model: accounts with no role assigned—typically expected to have zero permissions—are instead treated as implicitly authorized to access a REST API endpoint that performs file operations. Combined with unrestricted file path handling, this allows arbitrary code execution. The critical insight is that the 'no role assigned' state is not merely a misconfiguration — it's likely a forgotten provisioning artifact from initial system setup or emergency recovery procedures. When the system matured and RBAC was implemented, the code path supporting role-less authentication was never removed, only forgotten. This is why the vulnerability evades standard vulnerability scanning: scanners authenticate with valid credentials and receive expected responses, never seeing that the account they're using has no role because role assignment is invisible to unauthenticated callers. The operational risk extends beyond local impact. Splunk SOAR serves as an automation hub connecting ticketing systems, SIEMs, EDR platforms, and incident response workflows. Compromising a SOAR instance through this vulnerability means compromising the platform that instructs other security tools what to do. Many SOAR deployments intentionally use service accounts with minimal roles under the assumption those accounts only call 'safe' endpoints — this vulnerability breaks that assumption at the architectural level. Immediate actions: First, audit all user and service accounts for the 'no role assigned' state in your SOAR deployment. This is not a rare edge case — it's an operational state that may exist for provisioning accounts, integration accounts, or legacy service accounts. Second, identify every REST API endpoint in your deployment and verify each has explicit role requirements enforced, not inherited from authentication scaffolding. Third, review file operation endpoints for path restriction enforcement — user-supplied file paths should be confined to intended temporary directories. For compensating controls while patching: implement continuous role assignment auditing rather than relying on point-in-time scans. Network segmentation and API gateways help limit exposure but don't close the authorization gap. The vulnerability is configuration-derived rather than code-derived, meaning detection and remediation timelines are longer than typical CVEs — plan accordingly.

Reviewed through automated stages and approved by a human before publication.