CVE-2026-76378: Information Disclosure through Action Parameters in Cisco Secure Malware Analytics app for Splunk SOAR
In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the action's samplepassword parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cisco Secure Malware Analytics app for Splunk SOARto a version that resolves this vulnerability.Fixed in 2.4.5
Event History
Frequently Asked Questions
Who can view the sensitive sample password?
A user with a role that has permission to run actions can expose the sample password by invoking the detonate file action. The parameter is displayed in cleartext in the user interface.
Which deployments are affected?
Cisco Secure Malware Analytics app for Splunk SOAR versions below 2.4.5 are affected. The issue applies where the detonate file action is available to users permitted to run actions.
What configuration condition causes the exposure?
The detonate file action's sample_password parameter is not marked as a password. As a result, Splunk SOAR does not mask it in the user interface.