CVE-2026-76376

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2026-0806

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En versiones anteriores a la 2.1.9 de la aplicación AWS IAM para Splunk SOAR, un usuario con un rol que tiene permiso para ejecutar acciones podría exponer credenciales sensibles de AWS al invocar una acción que acepta el parámetro de credenciales, porque el parámetro no está enmascarado y se muestra en texto claro en la interfaz de usuario. La revelación de información es posible porque la aplicación no marca el parámetro de acción afectado como una contraseña. Para más información, consulte Ejecutar una acción en Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Information

Published : 2026-08-19 22:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-76376

Mitre link : CVE-2026-76376

CVE.ORG link : CVE-2026-76376

JSON object : View

Products Affected

No product.

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2026-76376", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76376", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T16:09:49.782621Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "product": "AWS IAM app for Splunk SOAR", "versions": [{"status": "affected", "version": "2.1", "lessThan": "2.1.9", "versionType": "custom"}]}]}], "published": "2026-08-19T22:17:23.577", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0806", "source": "psirt@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises)."}, {"lang": "es", "value": "En versiones anteriores a la 2.1.9 de la aplicaci\u00f3n AWS IAM para Splunk SOAR, un usuario con un rol que tiene permiso para ejecutar acciones podr\u00eda exponer credenciales sensibles de AWS al invocar una acci\u00f3n que acepta el par\u00e1metro de credenciales, porque el par\u00e1metro no est\u00e1 enmascarado y se muestra en texto claro en la interfaz de usuario. La revelaci\u00f3n de informaci\u00f3n es posible porque la aplicaci\u00f3n no marca el par\u00e1metro de acci\u00f3n afectado como una contrase\u00f1a. Para m\u00e1s informaci\u00f3n, consulte Ejecutar una acci\u00f3n en Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises)."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "psirt@cisco.com"}