CVE-2026-76379 in Webex App
Summary
by MITRE • 08/20/2026
In versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive meeting password by invoking the schedule meeting action, because the action's password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Cisco Webex app for Splunk SOAR versions prior to 2.2.1 represents a significant information disclosure flaw rooted in improper input validation and user interface design within the application's integration layer. Specifically, when an authenticated user possessing permissions to execute actions invokes the schedule meeting function, the system fails to obscure sensitive credentials associated with that action. The password parameter required for securing Webex meetings is rendered in cleartext on the user interface rather than being masked or hidden as expected for confidential data fields. This behavior occurs because the application developer did not explicitly mark this specific input field as a password type within the Splunk SOAR framework, leading to a failure in applying standard security controls that typically prevent sensitive values from being displayed plainly during execution or logging processes.
From a technical perspective, this flaw constitutes an instance of CWE-532, which is classified under Information Exposure Through Log Files, although it manifests here through direct UI exposure rather than solely via logs. The root cause lies in the configuration metadata associated with the action definition within the app package. By omitting the designation that signals the field to be treated as a secret or password, the underlying Splunk SOAR engine treats the input as standard text data. Consequently, any user interface component responsible for displaying command execution details or parameter summaries will render the value in its original form. This oversight allows individuals with access to the application's operational dashboard or audit trails involving action executions to view meeting passwords that should remain confidential, thereby undermining the security posture of scheduled Webex sessions.
The operational impact of this vulnerability is substantial, particularly for organizations relying on Splunk SOAR for automated incident response and workflow orchestration where sensitive credentials are routinely passed between systems. If an attacker gains access to a user account with sufficient privileges to view action logs or interface outputs, they can extract these cleartext passwords without needing to exploit complex injection techniques or bypass authentication mechanisms. This simplifies the attack vector significantly, as it relies on social engineering or basic privilege escalation rather than sophisticated exploitation of code logic flaws. The exposed meeting passwords could be leveraged by malicious actors to join private meetings, potentially leading to further data exfiltration, eavesdropping on sensitive corporate discussions, or using the compromised credentials for lateral movement if those passwords are reused across other services within the organization's infrastructure.
To mitigate this risk, organizations must immediately upgrade the Cisco Webex app for Splunk SOAR to version 2.2.1 or later, where the developers have corrected the parameter configuration to properly mask sensitive fields. In environments where upgrading is not instantly feasible, administrators should restrict access to users who can view action execution details and logs to only those with a strict need-to-know basis, thereby limiting exposure of cleartext credentials in interface outputs. Additionally, security teams should review other custom actions within their SOAR playbooks to ensure that all parameters handling secrets are correctly flagged as password types according to Splunk SOAR documentation standards. This proactive audit helps prevent similar information disclosure vulnerabilities across the automation platform and aligns with ATT&CK technique T1078, which involves valid accounts being used for unauthorized access or data theft through credential exposure.