Executive brief
Splunk SOAR is a security orchestration platform that helps organizations automate and manage security operations. In versions before 8.6.0, authenticated users with restricted roles can bypass access controls via the REST API to view confidential information about multi-tenant configurations they should not have access to, including names and identifiers of other tenants. This allows insiders to discover organizational structure and potentially target other business units.
Technical details
The vulnerability is an authorization bypass (CWE-863: Incorrect Authorization) in the REST API's multi-tenant tenant-listing endpoint. The root cause is that Splunk SOAR fails to enforce role-based tenant restrictions when returning tenant information through the REST API in multi-tenant deployments. An authenticated user with a restricted role can call REST API endpoints to enumerate all tenants in the system, bypassing the intended tenant access controls. No elevated privileges or user interaction are required beyond authentication; exploitation is trivial. The fix is to upgrade to Splunk SOAR 8.6.0 or later.
Affected products
- Splunk SOAR below 8.6.0
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in SOAR 8.6.0