CVE-2026-76385 in Venafi app for SOAR
Summary
by MITRE • 08/19/2026
In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystore_password and password parameters are not masked and are shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameters as passwords. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The Venafi app for Splunk SOAR, specifically in versions prior to 2.1.4, contains a critical information disclosure vulnerability that stems from improper handling of sensitive credential parameters within the application's user interface logic. This flaw allows any authenticated user possessing permissions to execute actions on the platform to inadvertently expose high-value secrets associated with certificate management operations. The core technical deficiency lies in the configuration of specific action inputs where the system fails to apply standard security masking protocols typically reserved for password fields. Consequently, when a user invokes the get certificate action, the underlying implementation does not recognize or treat the keystore_password and password parameters as sensitive data requiring obfuscation during display operations.
From an operational perspective, this vulnerability results in the cleartext exposure of cryptographic material credentials directly within the Splunk SOAR interface. These exposed values include both the passwords required to access encrypted keystores and private keys stored by Venafi. The presence of these secrets in plain text significantly increases the attack surface for malicious actors who may have gained legitimate but limited access to the orchestration platform. An attacker leveraging this flaw can harvest valid credentials that provide direct access to digital certificates, potentially facilitating unauthorized decryption of sensitive communications or impersonation attacks against systems relying on those specific identities.
This issue aligns with CWE-522, which categorizes information exposure through insufficiently protected data in user interfaces, and reflects a failure to implement proper input sanitization for display purposes. In the context of the MITRE ATT&CK framework, this vulnerability supports techniques related to Credential Access via Unsecured Credentials or Discovery of Sensitive Information stored locally within application configurations. The lack of masking indicates that the developers did not adhere to secure coding practices regarding the handling of secrets in graphical user interfaces, treating sensitive parameters as standard text inputs rather than protected fields requiring encryption at rest and obfuscation during runtime display.
To mitigate this risk, organizations running affected versions must immediately upgrade the Venafi app for Splunk SOAR to version 2.1.4 or later where these parameter masking issues have been resolved by marking the relevant fields as password types within the application configuration. Until an update is applied, administrators should restrict access to users with elevated privileges who require direct interaction with certificate management actions and monitor logs for unusual invocation patterns of the get certificate action. Additionally, it is advisable to rotate any keystore or private key passwords that may have been exposed through this interface during the period when the vulnerability was active in production environments to ensure continued confidentiality of cryptographic assets.