CVE-2026-76379: Information Disclosure through Action Parameters in Cisco Webex app for Splunk SOAR
In versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive meeting password by invoking the schedule meeting action, because the action's password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cisco Webex app for Splunk SOAR (Splunk SOAR connector)to a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A Splunk SOAR user with a role that permits running actions can expose a meeting password when invoking the schedule meeting action. No additional user interaction is required.
Which deployments are affected?
Cisco Webex app for Splunk SOAR versions below 2.2.1 are affected. The issue applies to the schedule meeting action because its password parameter is displayed in cleartext rather than masked.
How can teams reduce exposure before updating?
Restrict permission to run actions to users who require it, particularly for workflows that use the schedule meeting action. Avoid entering sensitive meeting passwords through that action where possible, since the parameter may be visible in the interface.