CVE-2026-76380 in OAuth API App for Splunk SOAR
Summary
by MITRE • 08/19/2026
In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive document password by invoking either the detonate file or detonate url action, because the action's document_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in CrowdStrike OAuth API applications for Splunk SOAR prior to version 5.1.3 represents a significant information disclosure risk stemming from improper handling of sensitive credentials within the application's user interface logic. This flaw specifically affects users who possess roles with permissions to execute actions, allowing them to inadvertently or intentionally expose confidential data through standard operational workflows. The core technical deficiency lies in the configuration and rendering of specific action parameters, particularly those designated for storing passwords such as document_passwords used during file detonation or URL analysis processes. Because the application fails to apply appropriate masking protocols to these fields, sensitive authentication details are rendered in cleartext within the graphical user interface whenever an affected action is invoked. This behavior contradicts fundamental security design principles that mandate the protection of credentials at rest and in use, thereby creating a direct pathway for unauthorized information leakage without requiring complex exploitation techniques or privilege escalation beyond existing role-based permissions.
From a technical perspective, this issue classifies as CWE-522, which denotes Insufficiently Protected Credentials, specifically focusing on the exposure of sensitive data through improper UI masking mechanisms. The vulnerability arises because the application framework does not explicitly flag the document_password parameter with attributes that trigger automatic obfuscation in the display layer. Consequently, when a user initiates actions such as detonating a file or analyzing a URL, the system retrieves and displays the stored password value directly to the operator rather than replacing it with asterisks or dots. This lack of visual protection means that any individual viewing the screen during execution, including potential shoulder surfers or users sharing workspace environments, can capture these credentials. Furthermore, if logs are generated containing UI state information without proper sanitization, this cleartext password could persist in system logs, amplifying the scope of exposure beyond immediate visual observation to persistent data repositories that may be accessed by other administrative personnel or stored insecurely on disk.
The operational impact of this vulnerability is substantial within a Security Operations Center environment where Splunk SOAR is utilized for automated threat response and incident handling. Analysts routinely interact with these applications to process indicators of compromise, making the exposure of API keys, service account passwords, or document decryption credentials a critical risk. If an attacker gains access to a user's workstation or compromises their session through phishing or malware, they can observe these cleartext credentials during routine action execution and subsequently use them to authenticate against external services managed by CrowdStrike or other integrated platforms. This could lead to unauthorized access to sensitive data stores, further lateral movement within the organization’s infrastructure, or abuse of API quotas leading to service disruption. The ease of exploitation means that no specialized tools are required; simply running a standard action while an observer is present suffices to extract valuable authentication material, effectively bypassing traditional perimeter defenses by leveraging legitimate administrative functions.
To mitigate this vulnerability and align with industry best practices such as MITRE ATT&CK technique T1078 which involves valid accounts being used for initial access or persistence, organizations must immediately upgrade the CrowdStrike OAuth API app for Splunk SOAR to version 5.1.3 or later where these masking issues have been resolved by developers. In addition to upgrading, administrators should review role-based access controls to ensure that only essential personnel can execute actions involving sensitive credential parameters, thereby reducing the number of individuals exposed to potential visual eavesdropping. It is also recommended to implement strict log monitoring and sanitization policies within Splunk SOAR to prevent any residual cleartext passwords from being written to audit logs or debug outputs. Regular security audits should include checks for proper parameter masking configurations across all installed apps, ensuring that fields designated as sensitive are consistently marked with appropriate obfuscation attributes in the application codebase. This holistic approach addresses both the immediate technical flaw and the broader operational risks associated with credential management in automated security platforms.