Description

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack requires the attacker to have network-path interception capability between Splunk SOAR and the configured CyberArk REST server. For more information see Manage your organization's credentials with a password vault (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/configure-administration-settings-in-splunk-soar-cloud/manage-your-organizations-credentials-with-a-password-vault) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-19T22:17:21.533Z",
  "pubdate": "2026-08-19T22:17:21.533Z",
  "executiveSummary": "A missing certificate verification vulnerability exists within Splunk SOAR versions below 8.6.0 when interacting with a configured CyberArk Representational State Transfer (REST) server. This cryptographic implementation flaw allows an unauthenticated attacker capable of observing or altering network traffic between Splunk SOAR and the CyberArk REST server to compromise the confidentiality and integrity of exchanged credential management data. The primary impact includes the potential exposure or unauthorized modification of all relevant data transmitted through the credential manager. Exploitation of this vulnerability requires the attacker to possess network-path interception capabilities, commonly known as an on-path or Man-in-the-Middle (MitM) position, between the affected Splunk SOAR instance and the external CyberArk REST server. The risk implication is significant, as credential vaults are high-value targets containing sensitive authentication materials that, if compromised, could lead to broader unauthorized access across integrated systems.",
  "technicalDetails": "The root cause of this vulnerability is that the CyberArk REST client implementation within Splunk SOAR does not verify server certificates by default during the establishment of TLS/HTTPS connections. Consequently, the client fails to validate the cryptographic trust chain, hostname, and validity period of the SSL/certificate presented by the remote CyberArk REST server.\nThe vulnerable component is the CyberArk REST client integrated into Splunk SOAR versions below 8.6.0. The vulnerability requires zero authentication and no initial privileges from the attacker's perspective, but it does mandate specific network exposure: the attacker must achieve a network-path interception capability between the Splunk SOAR server and the configured CyberArk REST server.\nThe attack flow proceeds as follows: First, an unauthenticated attacker positions themselves on the network path between the Splunk SOAR deployment and the CyberArk REST server. Second, when Splunk SOAR initiates a communication session to retrieve or manage credentials from the vault via the REST API, the CyberArk REST client fails to validate the server's TLS certificate. Third, the attacker intercepts the connection, allowing them to impersonate the legitimate CyberArk REST server through a forged certificate without triggering client-side validation errors or warnings. Fourth, because certificate validation is omitted, the Splunk SOAR instance blindly trusts the malicious interceptor and establishes a secure TLS tunnel directly with the attacker.\nThe post-exploitation impact includes complete compromise of the communication channel. The attacker can decrypt, read, harvest, or modify all relevant data exchanged through the credential manager, including sensitive tokens, passwords, and administrative metadata transmitted during the transaction. This enables subsequent unauthorized access and lateral movement across systems managed by the compromised credentials."
}