EUVD-2026-107646
GHSA-6p7q-8j84-xg97
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege SOAR user
-
ExploitRequest installed-app archive export endpoint
-
ImpactDownload archive exposing proprietary source and secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated Splunk SOAR (On-premises) account whose role does NOT include the view-apps permission (PR:L); the attacker then invokes the app export/archive-download function, which fails to verify app-view permission before returning the archive. Limiting factors: valid platform credentials are mandatory, the instance must run a version below 8.7.0, and the payoff is bounded to confidentiality of installed-app archives (source code and embedded secrets) - there is no code execution, data modification, or availability impact. Risk scales with the number of low-trust users provisioned on the SOAR instance. |
| Impact | This is a moderate-severity information-disclosure issue, not a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent with the description: a network-reachable endpoint, low attack complexity, and a low-privilege authenticated user (PR:L) who simply lacks the app-view permission. The only impact is confidentiality (C:H) - exposure of app archives including proprietary source code and embedded secrets - with no integrity or availability effect, matching CWE-862 (Missing Authorization). No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so by the exploitation-status rule this is 'no public exploit identified at time of analysis.' The signals do not conflict, but note that exploitation is gated behind valid authentication on the SOAR platform, which meaningfully limits the attacker population to existing (possibly insider or compromised-credential) users rather than anonymous internet attackers - this tempers the C:H rating in real-world terms. Treat as a routine-priority patch, elevated only in environments where many low-trust users share a SOAR instance. |
| Exploit ScenarioDerived | A low-privileged but authenticated Splunk SOAR user (for example an analyst whose role deliberately excludes app-management rights) calls the app-export/archive endpoint for an installed app and receives the full archive. The returned archive exposes proprietary connector source code and any sensitive data or credentials bundled in the app. No public exploit code is identified; exploitation requires only valid platform credentials and a crafted request to the export function. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Splunk SOAR deployments below 8.7.0 allow any authenticated user whose role omits the view-apps permission to export and download an installed app archive, exposing proprietary source code and any sensitive data or secrets embedded in that package. The flaw is a missing authorization check in the app export path, rated CVSS 6.5 with confidentiality-only impact. No public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires a valid low-privileged account on the SOAR instance.
RemediationAI
Vendor-released patch: upgrade Splunk SOAR (On-premises) to 8.7.0 or later, which adds the missing permission check before an app archive is returned; consult Splunk advisory SVD-2026-1010 at https://advisory.splunk.com/advisories/SVD-2026-1010 for the authoritative fixed-release guidance. If immediate upgrade is not possible, reduce exposure by auditing and tightening roles so that only trusted administrators hold app-management capabilities, and by restricting network or reverse-proxy access to the app export/import endpoints to trusted administrative users or management networks; the trade-off is that legitimate app development, backup, and migration workflows may be disrupted until the upgrade is completed. Review existing low-privilege accounts and remove unnecessary users, since the risk scales with the number of non-administrative accounts provisioned on the SOAR instance. Rotate any secrets that may have been embedded in app archives if unauthorized downloads are suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 Missing Authorization: Splunk SOAR fails to verify that the requesting user holds the view-apps permission before returning an installed app archive through the export/import workflow. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms a network-reachable, low-privilege authenticated attack with no user interaction and high confidentiality impact, but no integrity or availability impact. The NVD CPE cpe:2.3:a:splunk:splunk_soar:*:*:*:*:*:*:*:* represents the affected product family; the advisory scopes the issue to releases before 8.7.0. The underlying feature is the app export capability used for backup, migration, and development, which packages application code and configuration. Because archives can contain proprietary source code and embedded sensitive information, the missing permission gate turns a legitimate administrative function into an information-disclosure vector for low-trust users.
Know when Splunk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable endpoint and low complexity, but a valid authenticated account is required so PR:L; impact is confidentiality-only (C:H) from exposed source/secrets, no integrity or availability effect.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
1DescriptionCVE.org
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information. The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive. For more information see Export or import an app (https://help.splunk.com/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/export-or-import-an-app) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
Exploit-DB