Description

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The Server-Side Request Forgery (SSRF) is possible because the connectivity check REST API does not sufficiently validate the destination before Splunk SOAR connects to it. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-19T22:17:21.397Z",
  "pubdate": "2026-08-19T22:17:21.397Z",
  "executiveSummary": "A Server-Side Request Forgery vulnerability exists in Splunk SOAR versions below 8.6.0. The security flaw resides within the /rest/support/connectivity/.../check_connectivity endpoint, which fails to adequately validate user-supplied destination parameters prior to connection initiation. This enables an authenticated adversary assigned the Administrator role to leverage the application server as a proxy, forcing Splunk SOAR to dispatch outbound network connections to arbitrary external and internal endpoints. The primary risk implication involves internal reconnaissance capabilities, allowing a malicious actor to probe internal networks, map reachable internal hosts, and discover open ports behind the security perimeter that would otherwise be inaccessible. Successful exploitation requires administrative privileges within the application and relies on abusing legitimate administrative diagnostic functionality to trigger unauthorized network traffic originating from the vulnerable server infrastructure.",
  "technicalDetails": "The vulnerability is caused by insufficient input validation within the connectivity check REST API of Splunk SOAR. Specifically, the /rest/support/connectivity/.../check_connectivity endpoint processes parameters that dictate the target destination for diagnostic network connectivity checks. Because the underlying application logic lacks robust destination whitelisting and proper URI parsing defenses, the server blindly accepts arbitrary destinations supplied via the API request.\nThe attack flow proceeds as follows: an authenticated attacker possessing the Administrator role crafts an HTTP request targeting the vulnerable /rest/support/connectivity/.../check_connectivity endpoint. Within this request, the attacker specifies a targeted IP address, domain name, and port combination corresponding to an internal asset or external entity. Upon receiving the request, the Splunk SOAR server initiates an outbound network connection from its own network interface to the specified target destination.\nBy analyzing the response characteristics, error messages, or connection timeouts returned by the API, the attacker can systematically determine whether specific internal hosts and ports are active and reachable. This facilitates network mapping and internal reconnaissance from the privileged context of the Splunk SOAR deployment. The vulnerable component is the connectivity check subsystem responsible for handling network diagnostic utilities. Affected versions encompass all deployments of Splunk SOAR prior to version 8.6.0. The exploitation vector requires authentication and administrative privileges, limiting unauthenticated network-based exploitation but introducing significant risk via privilege escalation, malicious insider threats, or compromised administrative credentials."
}