CVE-2026-76375: Information Disclosure through Environment Data Logging in AD LDAP app for Splunk SOAR
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AD LDAP app for Splunk SOAR (affected connector)to a version that resolves this vulnerability.Fixed in 2.3.8
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must hold a Splunk SOAR role that permits running actions. Exploitation does not require user interaction and can be performed remotely through action execution.
Which deployments are affected?
Versions of the AD LDAP app for Splunk SOAR below 2.3.8 are affected. The issue is triggered when an action causes the connector process environment to be written to a persistent debug log in plaintext.
What information could be exposed?
Sensitive credentials present in the connector process environment may be disclosed. The available information does not identify specific credential types or environment variables.