CVE-2026-76383

In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's token_serial parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2026-0806

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En versiones anteriores a la 1.0.5 de la aplicación RSA SecurID Authentication Manager para Splunk SOAR, un usuario con un rol que tiene permiso para ejecutar acciones podría exponer un número de serie de token sensible al invocar la acción enable token o revoke token, porque el parámetro token_serial de la acción no está enmascarado y se muestra en texto claro en la interfaz de usuario. La revelación de información es posible porque la aplicación no marca el parámetro de acción afectado como una contraseña. Para más información, consulte Ejecutar una acción en Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Information

Published : 2026-08-19 22:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-76383

Mitre link : CVE-2026-76383

CVE.ORG link : CVE-2026-76383

JSON object : View

Products Affected

No product.

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2026-76383", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76383", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T16:04:42.673610Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "product": "RSA SecurID Authentication Manager app for Splunk SOAR", "versions": [{"status": "affected", "version": "1.0", "lessThan": "1.0.5", "versionType": "custom"}]}]}], "published": "2026-08-19T22:17:24.467", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0806", "source": "psirt@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's token_serial parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises)."}, {"lang": "es", "value": "En versiones anteriores a la 1.0.5 de la aplicaci\u00f3n RSA SecurID Authentication Manager para Splunk SOAR, un usuario con un rol que tiene permiso para ejecutar acciones podr\u00eda exponer un n\u00famero de serie de token sensible al invocar la acci\u00f3n enable token o revoke token, porque el par\u00e1metro token_serial de la acci\u00f3n no est\u00e1 enmascarado y se muestra en texto claro en la interfaz de usuario. La revelaci\u00f3n de informaci\u00f3n es posible porque la aplicaci\u00f3n no marca el par\u00e1metro de acci\u00f3n afectado como una contrase\u00f1a. Para m\u00e1s informaci\u00f3n, consulte Ejecutar una acci\u00f3n en Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises)."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "psirt@cisco.com"}