CVE-2026-76390

Summary

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.

Affected Software

Weaknesses

• CWE-200: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Workarounds

Turn off or remove the Cisco Talos Intelligence for Enterprise Security Cloud app. For more information see Manage app and add-on objects in the Splunk documentation.

References

• https://advisory.splunk.com/advisories/SVD-2026-0808

• ←Previous
• Next→