CVE-2026-76382 in Phantom
Summary
by MITRE • 08/20/2026
In versions below 3.8.5 of the Phantom app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking the deflate item action, because the action's password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Splunk SOAR Phantom application versions prior to 3.8.5 represents a critical information disclosure flaw rooted in improper input handling and user interface design. The core technical issue lies within the deflate item action, where the parameter designated for sensitive archive passwords is not correctly flagged as a secure credential field by the application framework. In modern security orchestration platforms like Splunk SOAR, parameters that contain secrets such as API keys or passwords must be explicitly marked with specific metadata attributes to trigger masking behaviors in both the graphical user interface and underlying logs. Because this particular parameter lacked the necessary designation for password protection, the system treated it as a standard text input field rather than a sensitive data element. This oversight allows any authenticated user possessing the requisite role permissions to execute actions that interact with archive files, inadvertently causing the plaintext value of the password to be rendered visibly in the application interface during execution or review of action results.
From an operational perspective, this flaw facilitates unauthorized access and potential compromise of downstream systems protected by these archived credentials. An attacker who has gained a foothold within the Splunk SOAR environment, either through compromised user accounts or insufficient role-based access control enforcement, can exploit this visibility to harvest sensitive authentication material without triggering typical security alerts associated with credential theft. The exposure occurs directly in the user interface, meaning that any individual viewing the screen during action execution or reviewing historical run data could observe the cleartext password. This undermines the principle of least privilege and compromises the confidentiality of credentials used for integrating various security tools and infrastructure components managed by the SOAR platform.
This vulnerability aligns with CWE-200, which classifies Information Exposure as a category where sensitive information is disclosed to unauthorized actors due to improper handling or display mechanisms. Furthermore, it relates to CWE-532 regarding Log Forging if such cleartext passwords were also inadvertently written into system logs, although the primary vector described here is UI exposure. In terms of adversarial tactics, this flaw supports techniques associated with Credential Access within the MITRE ATT&CK framework, specifically those involving harvesting credentials from local systems or applications where security controls are misconfigured. The lack of masking indicates a failure in implementing proper data classification and protection standards for sensitive inputs within the application logic.
To mitigate this risk, organizations running affected versions must upgrade the Phantom app to version 3.8.5 or later, where the parameter is correctly configured to mask password fields. Until the update is applied, administrators should enforce strict role-based access controls to limit who can execute actions involving sensitive archives and monitor user activity for any unusual patterns of action execution that might indicate exploitation attempts. Additionally, reviewing existing run history for potential exposure of passwords in cleartext format is recommended to assess the scope of the impact. Implementing robust secret management practices and ensuring all custom or third-party apps adhere to Splunk SOAR security guidelines regarding credential handling will help prevent similar information disclosure vulnerabilities in the future.