Description

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T22:17:25.357Z",
  "pubdate": "2026-08-19T22:17:25.357Z",
  "executiveSummary": "An information disclosure vulnerability affects Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, specifically involving the unauthorized exposure of the add-on OpenAPI specification through Splunk Web static file paths.\nThe vulnerability allows an unauthenticated remote attacker to retrieve the generated OpenAPI specification without requiring any credentials or session tokens.\nThe primary impact of this flaw is unauthorized reconnaissance of the add-on Representational State Transfer (REST) API endpoints and the underlying authentication model.\nRisk implications include aiding threat actors in mapping out the API attack surface, identifying potential secondary functional flaws, and facilitating targeted follow-up exploits against the affected deployment.\nExploitation requirements are minimal, as the attacker requires only network access to Splunk Web and the ability to query the specific unauthenticated static file path where the OpenAPI document is improperly hosted.",
  "technicalDetails": "The root cause of the vulnerability stems from improper access control configuration within the deployment architecture of Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3.\nSpecifically, the generated OpenAPI specification file is packaged and placed within a static file path natively served by Splunk Web.\nSplunk Web serves these designated static file paths without enforcing authentication checks, failing to restrict access to sensitive documentation assets that describe administrative or functional interfaces.\nThe affected component is the static file serving mechanism of Splunk Web handling the Cisco Talos Intelligence for Enterprise Security Cloud add-on resources.\nNetwork exposure is defined by the accessibility of the Splunk Web interface, which is typically exposed to internal networks or, in misconfigured environments, directly to the internet.\nAuthentication and privilege requirements are entirely absent for the initial reconnaissance phase, allowing unauthenticated users to execute the lookup.\nThe attack flow proceeds as follows: First, an unauthenticated user or automated scanner targets the Splunk Web instance hosting the vulnerable add-on. Second, the actor issues an HTTP GET request directly to the predictable static file path containing the OpenAPI specification. Third, Splunk Web serves the file without validating user sessions or permissions. Fourth, the client receives the comprehensive OpenAPI document containing structured details regarding internal REST API endpoints, parameters, request schemas, and authentication models. Finally, the attacker parses the retrieved specification to identify high-value API routes for subsequent targeted exploitation attempts."
}