Cisco Talos <1.0.3: Unauth OpenAPI Spec Exposure via Splunk Web
CVE-2026-76390 Published on August 19, 2026
Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.
Weakness Type
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2026-76390 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2026-76390
Want to know whenever a new CVE is published for Splunk Cloud? stack.watch will email you.
Affected Versions
Splunk Cisco Talos Intelligence for Enterprise Security Cloud:- Version 1.0 and below 1.0.3 is affected.