CVE‑2026‑76304 permits an authenticated Splunk SOAR user who lacks Automation Broker edit permissions to download the broker's Docker Compose configuration file. The file exposes the Splunk SOAR instance URL, the container image location, and the broker version, revealing internal network topology and tooling details. This unauthorized disclosure aligns with CWE‑862 and, while it does not expose passwords or credentials, it provides valuable information to an attacker that could facilitate further reconnaissance or targeted attacks.

The vulnerable component is Splunk SOAR. The impact applies to all Splunk SOAR releases earlier than version 8.7.0, as the vendor’s mitigation specifically targets upgrades to 8.7.0 or newer. No finer version granularity was supplied in the advisory.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalogue, so there is no evidence of widespread exploitation yet. Nevertheless, any authenticated user who does not have the required edit role can freely retrieve the file, making the attack path trivial for users with basic access privileges inside the organization. No public exploits are documented as of the advisory release.