CVE-2026-76377: Information Disclosure through Action Parameters in Azure AD Graph app for Splunk SOAR
In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temppassword parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Azure AD Graph app for Splunk SOARto a version that resolves this vulnerability.Fixed in 2.5.3 - Upgrade
Upgrade
Splunk SOARto a version that resolves this vulnerability.Fixed in 8.6.0
Event History
Frequently Asked Questions
Who can expose the sensitive value?
Any user assigned a role that permits running actions can expose the temporary password through the reset password action in affected versions.
What must an attacker do to exploit this issue?
The attacker needs authenticated access to Splunk SOAR with permission to run actions, then invokes the Azure AD Graph app's reset password action. The temp_password action parameter is displayed in cleartext in the user interface.
How can I determine whether my deployment is affected?
Check the installed version of the Azure AD Graph app for Splunk SOAR. Versions below 2.5.3 are affected; version 2.5.3 or later is not identified as affected by the provided advisory.
What can be done if the app cannot be updated immediately?
Restrict permission to run actions to only trusted users, particularly for users who could invoke the reset password action. This reduces who can cause the temporary password to be displayed in the interface.