Splunk App for Splunk SOAR up to 3.2.1 password/pmi_password missing encryption

Summaryinfo

A vulnerability classified as problematic was found in Splunk App for Splunk SOAR up to 3.2.1. This issue affects some unknown processing. The manipulation of the argument password/pmi_password results in missing encryption. This vulnerability is known as CVE-2026-76386. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Splunk App for Splunk SOAR up to 3.2.1. It has been classified as problematic. Affected is an unknown function. The manipulation of the argument password/pmi_password with an unknown input leads to a missing encryption vulnerability. CWE is classifying the issue as CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. This is going to have an impact on confidentiality. CVE summarizes:

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and pmi_password parameters are not masked and are shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameters as passwords. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

The advisory is shared for download at advisory.splunk.com. This vulnerability is traded as CVE-2026-76386 since 08/19/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 3.2.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• App for Splunk SOAR

Version

• 3.2.0
• 3.2.1

License

• free

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion