CVE-2026-76390

Executive Summary

CVE-2026-76390 is an information disclosure vulnerability affecting Cisco Talos Intelligence for Splunk Enterprise Security Cloud versions below 1.0.3. An unauthenticated remote attacker can retrieve the add-on's OpenAPI specification by requesting a static file path served by Splunk Web, which is accessible without authentication. The exposed specification discloses REST API endpoints and the authentication model, enabling reconnaissance for subsequent attacks. The vulnerability carries a CVSS score of 5.3 (Medium) and is currently unpatched per available intelligence sources, though a fix exists in version 1.0.3.

Technical Analysis

The vulnerability exists in Cisco Talos Intelligence for Splunk Enterprise Security Cloud (an add-on for Splunk) versions prior to 1.0.3. The root cause is improper packaging of development artifacts: the OpenAPI specification — generated as part of the add-on's REST API development lifecycle — is placed in a static file path that Splunk Web serves to any requester without authentication enforcement.

Splunk Web's static file serving mechanism is designed to deliver assets such as JavaScript, CSS, images, and other client-side resources. When the add-on is installed, the OpenAPI specification (typically a JSON or YAML document describing all API endpoints, request/response schemas, parameters, and authentication requirements) is copied into the static resources directory. Because Splunk Web serves these paths without requiring a logged-in session, any unauthenticated user who can reach the Splunk Web port (typically 8000/TCP) can download the specification file.

The information disclosed includes:

• REST API endpoint paths: Enables attackers to learn the exact URLs for all API functions exposed by the add-on.
• HTTP methods per endpoint: Reveals which operations (GET, POST, PUT, DELETE, etc.) are supported.
• Request parameters and schemas: Provides the exact input structure needed to craft valid API requests.
• Authentication model: Documents how the API authenticates requests (e.g., token-based, session-based), allowing attackers to plan around authentication bypasses or credential-stealing efforts.

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates: network-accessible, low attack complexity, no privileges required, no user interaction, and a low confidentiality impact with no integrity or availability impact. The attack requires only that the Splunk Web interface is reachable — no credentials are needed.

No specific file paths, endpoint names, or API function names have been publicly disclosed in the NVD description beyond the reference to "Splunk Web static file paths." The precise URL pattern for accessing the OpenAPI specification remains undetermined from available data; further analysis would require examining the add-on package contents on a vulnerable installation.

Exploitation Scenarios

The attack chain for CVE-2026-76390 is straightforward due to the unauthenticated nature of the information disclosure. While no public proof-of-concept exists, the attack is inferred from the vulnerability class and available description.

Step 1 — Reconnaissance / Target Identification: The attacker identifies Splunk instances running the Cisco Talos Intelligence add-on. This can be accomplished via:

• Shodan/Censys searches for Splunk Web login pages (port 8000) or Splunk REST API (port 8089).
• Banner grabbing on Splunk Web HTTP responses, which may reveal version information.
• Sending a request to the Splunk Web root and analyzing the response for indications of the Talos Intelligence add-on (e.g., specific static resource references in HTML).

Typical Shodan dorks may include: "Splunkd" port:8089, http.title:"Splunk" port:8000, "splunk" "talos" for assets that expose affected service fingerprints.

Step 2 — Triggering the Flaw: The attacker sends a direct HTTP GET request to the Splunk Web static file path that serves the OpenAPI specification. Because the path is in the static asset directory, Splunk Web returns the file without requiring authentication. The exact URL path is not disclosed in the NVD description; however, the attacker can brute-force or enumerate common static file patterns (e.g., /en-US/static/app/<app_id>/openapi.json) to locate the specification. The response is the raw OpenAPI JSON/YAML document.

Step 3 — Payload / Execution Method: No payload is required — the vulnerability is triggered purely by an unauthenticated HTTP request to a predictable static resource. The information is served directly in the response body. Since the CNA description confirms the specification is packaged in "a static file path that Splunk Web serves without authentication," the request pattern is simply an HTTP GET to a known or guessable path. Attackers with prior knowledge of the add-on's package structure (obtainable by downloading the add-on from Splunkbase or Cisco's repository) can predict the exact path.

Step 4 — Post-Exploitation Impact: After obtaining the OpenAPI specification, the attacker gains a complete map of the add-on's REST API surface, including:

• Endpoint paths and HTTP methods.
• Authentication requirements (token placement, session schemes).
• Input data schemas for crafting valid requests.
• Error codes and response formats that reveal internal logic.

This information is then used for targeted attacks: attempting to access API endpoints directly with forged or stolen tokens, looking for logic flaws in input validation, crafting phishing campaigns that apelegitimate API interactions, or identifying endpoints that lack proper authorization checks. The disclosed information materially reduces the effort required for further exploitation.

Attack Class Limitation: Because the NVD description does not disclose the actual file path, specific exploitation requests cannot be enumerated in this report. It is acceptable to note: "No public PoC available; the attack chain is inferred from the vulnerability class and API specification disclosure mechanism."

Impact Assessment

CVSS Analysis: The severity is rated 5.3 (Medium). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N breaks down as follows: Attack Vector = Network, meaning the vulnerability is exploitable remotely; Attack Complexity = Low, as no special conditions are required; Privileges Required = None, confirming unauthenticated access; User Interaction = None; Scope = Unchanged; Confidentiality Impact = Low, as only API specification metadata is leaked, not sensitive operational data; Integrity and Availability impacts are None.

Business Impact:

• Information Disclosure: The OpenAPI specification reveals the full API attack surface, including internal naming conventions, API versioning, and authentication schemes. This is considered sensitive design information that enables targeted attacks. For an enterprise security product (Talos Intelligence), the disclosure could reveal internal detection/mitigation logic, though the NVD description focuses on API metadata rather than threat detections themselves.
• Downstream Compromise: The primary business risk is that the disclosed specification enables further exploitation of the add-on's REST API. If API endpoints lack proper authorization checks (beyond the documented authentication model), attackers could trigger actions such as retrieving threat intelligence data, modifying configurations, or performing actions with elevated privileges that should be restricted to authenticated users.
• Compliance Concerns: For organizations subject to regulatory requirements (e.g., PCI DSS, HIPAA, GDPR), an unauthenticated information disclosure may constitute a reportable security incident depending on the sensitivity of the data exposed and internal policies.

Affected Systems: Any Splunk Enterprise Security deployment (Cloud or On-prem) running Cisco Talos Intelligence for Splunk Enterprise Security version below 1.0.3. The description specifically notes "Enterprise Security Cloud," but the Splunk documentation link references general deployment guidance, suggesting both cloud and on-prem installations may be impacted.

Blast Radius: The impact is limited to disclosure of API metadata — no direct data integrity or availability loss. However, the disclosure seeds further attacks. If the add-on's API itself has vulnerabilities (including future ones disclosed after this CVE), the leaked specification amplifies their exploitability. For a security product used in defensive operations (Splunk ES with Talos intelligence), a compromised instance could misinform threat detections or be used as a pivot into the wider Splunk environment.

Detection Guidance

Sigma Rule

The following Sigma rule detects unauthenticated access to OpenAPI specification files on Splunk Web static paths — a behavior consistent with CVE-2026-76390 exploitation.

title: Unauthenticated Access to OpenAPI Specification - Cisco Talos Splunk Add-on
id: 2e87460b-9f5e-4c1d-8c0e-3f8a4b2e1c7d
status: experimental
description: Detects HTTP GET requests to Splunk Web static file paths that serve OpenAPI specification files, indicating possible CVE-2026-76390 exploitation attempts.
author: ValtersIT Threat Intelligence
date: 2026-05-15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-76390
logsource:
    category: webserver
    product: splunk
    service: splunkd
detection:
    selection:
        cs-method: 'GET'
        cs-uri-path:
            - '*/static*/openapi.json'
            - '*/static*/openapi.yaml'
            - '*/static*/openapi.yml'
            - '*/static*/swagger.json'
            - '*/static*/swagger.yaml'
            - '*/static*/api-docs*'
            - '*/static*/openapi*'
    filter_internal:
        cs-username: 'splunk-system-user'
    condition: selection and not filter_internal
level: medium
falsepositives:
    - Legitimate development or testing access to OpenAPI specs from authenticated users
tags:
    - attack.t1083
    - cve.2026.76390
    - cwe.200

YARA Rule

The following YARA rule detects the presence of the exposed OpenAPI specification file on disk within Splunk installations — useful for post-compromise forensic analysis.

rule CVE_2026_76390_Talos_OpenAPI_Spec
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects OpenAPI specification files associated with Cisco Talos Intelligence for Splunk Enterprise Security"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76390"
        severity = "medium"
        cve = "CVE-2026-76390"
    strings:
        $a = "openapi" ascii nocase
        $b = "talos" ascii nocase
        $c = "x-tagGroups" ascii nocase
        $d = "apiVersion" ascii nocase
        $e = "/services" ascii nocase
        $f = "authentication" ascii nocase
        $g = "securitySchemes" ascii nocase
        $h = "splunk" ascii nocase
    condition:
        filesize > 1KB and filesize < 5MB and
        (uint32(0) == 0x0A7B0D0A or uint32(0) == 0x0A5B0D0A) and
        2 of ($a, $b, $c, $d) and
        1 of ($e, $f, $g, $h)
}

Suricata IDS Rule

The following Suricata rule detects unauthorized access attempts to static OpenAPI specification paths on Splunk Web.

alert http any any -> any any (msg:"CVE-2026-76390 - Unauthenticated OpenAPI Spec Access on Splunk Web"; flow:established,to_server; content:"GET"; http_method; content:"/static/"; http_uri; content:"openapi"; http_uri; nocase; content:"Splunk"; http_header; nocase; classtype:attempted-recon; sid:300000001; rev:1; metadata:created_at 2026_05_15, updated_at 2026_05_15, cve CVE-2026-76390, cwe CWE-200, mitre_tactic TA0007, mitre_technique T1083;)

Elastic Detection

The following Elastic EQL rule detects HTTP requests to static Splunk paths containing OpenAPI references.

sequence by host.name, source.ip with maxspan=30s
  [ network where event.type == "start" and
    destination.port == 8000 and
    network.protocol == "http" ]
  [ http where event.type == "request" and
    http.request.method == "GET" and
    http.request.uri contains "/static/" and
    (http.request.uri contains "openapi" or
     http.request.uri contains "swagger" or
     http.request.uri contains "api-docs") ]

Splunk SPL Query

The following SPL query searches Splunk's native HTTP access logs for requests to static OpenAPI specification files from external or unauthenticated sources.

index=_internal sourcetype=splunk_web_access
| where like(uri_path, "%/static/%") 
    AND (like(uri_path, "%openapi%") 
         OR like(uri_path, "%swagger%") 
         OR like(uri_path, "%api-docs%"))
| eval auth_required=if(match(user, "splunk-system-user") OR user="-" OR isnull(user), "no", "yes")
| search auth_required=yes
| stats count by clientip, uri_path, method, status, user
| sort - count

Wazuh OSSEC Rule

The following Wazuh rule detects repeated access to OpenAPI specification paths in Splunk Web access logs.

<group name="splunk, cve-2026-76390,">
  <rule id="310101" level="10">
    <if_sid>310000</if_sid>
    <regex>GET\s+.*\/static\/.*(openapi|swagger|api-docs)</regex>
    <description>CVE-2026-76390: Unauthenticated request to OpenAPI spec on Splunk Web</description>
    <group>splunk_web_unauthenticated_api_spec_access</group>
    <mitre>
      <id>T1083</id>
    </mitre>
  </rule>
  <rule id="310102" level="12">
    <if_sid>310101</if_sid>
    <same_source_ip/>
    <time>5m</time>
    <description>CVE-2026-76390: Repeated unauthenticated OpenAPI spec access - possible reconnaissance</description>
    <group>splunk_web_unauthenticated_api_spec_access_repeated</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CVE-2026-76390 has a patch confidence of 0/4 — no public patch evidence exists from tracked sources. However, the NVD description references version 1.0.3 as the fixed version ("versions below 1.0.3"), and the vendor (Cisco via Splunk distribution) has implied a fix by setting the affected range. The lack of public patch notes may indicate a delayed advisory publication or an internally shipped fix without formal documentation.

Immediate Mitigations (no patch available yet):

1. Restrict Network Access: Limit access to the Splunk Web interface (port 8000) to only trusted networks/IP ranges using firewall rules or network access control lists. If Splunk Web does not need to be public-facing, block external access entirely.
2. Reverse Proxy Authentication: Place a reverse proxy (nginx, Apache, HAProxy) in front of Splunk Web that enforces authentication at the proxy layer, preventing unauthenticated requests from reaching the static file paths.
3. File Permissions: If feasible, remove the OpenAPI specification files from the static directory on affected installations. Identify the static resource directory for the Talos Intelligence add-on and delete or move the .json/.yaml OpenAPI files. This breaks the attack vector while retaining Splunk functionality.
4. Monitor Access Logs: Actively monitor Splunk Web access logs for requests matching known OpenAPI static path patterns. Enable the detection rules provided in this report.

Patch/Upgrade Steps:

1. Upgrade to Cisco Talos Intelligence for Splunk Enterprise Security version 1.0.3 or later. The upgrade should be performed through the Splunk app management interface (Splunk Web → Apps → Manage Apps → Find More Apps) or manually via the Splunk deployment server.
2. After upgrading, verify the OpenAPI specification is no longer accessible via unauthenticated static paths. Use the detection rules above to preemptively test.
3. Check for the Cisco Talos advisory referenced in the NVD description for specific upgrade instructions and any additional configuration requirements.

Long-Term Hardening:

1. Least Privilege: Review the Talos Intelligence add-on's REST API to ensure all endpoints perform authorization checks beyond the documented authentication model. API endpoints should require valid session/token credentials and appropriate role-based access controls.
2. Network Segmentation: Place Splunk Enterprise Security in a dedicated security zone with strict ingress controls. Only security operations staff should have direct access to Splunk Web.
3. Regular Version Management: Subscribe to Cisco Talos/Splunk security advisories to receive early notifications of add-on vulnerabilities. Maintain a patching SLA for Splunk apps and add-ons.
4. Development Hygiene: Advocate with the vendor to adopt practices preventing artifact leakage: OpenAPI specs should be generated at runtime or served through authenticated endpoints only, never packaged in static resource directories.
5. Monitor the API Surface: Periodically review the Talos Intelligence add-on's REST API for new endpoints or behavior changes after upgrades, and update detection rules and monitoring accordingly.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-76390 — Official NVD record for CVE-2026-76390, including CVSS vector and CWE classification.
2. Splunk Documentation — Deploy Cisco Talos Intelligence for Splunk Enterprise Security: https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only — Referenced in the NVD description as the authoritative deployment guide for the affected component.
3. CWE-200 Specification: https://cwe.mitre.org/data/definitions/200.html — Detailed definition of the CWE-200 vulnerability class (Exposure of Sensitive Information).
4. MITRE ATT&CK T1083: https://attack.mitre.org/techniques/T1083/ — File and Directory Discovery technique used by attackers to locate exposed files.

As of this report, no known threat actor campaigns have been attributed to CVE-2026-76390, and no exploits in the wild have been publicly reported. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. Monitoring should continue as the patch is distributed and security researchers may begin analyzing the exposed OpenAPI path patterns.