CVE-2026-76380: Information Disclosure through Action Parameters in CrowdStrike OAuth API app for Splunk SOAR
In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive document password by invoking either the detonate file or detonate url action, because the action's documentpassword parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CrowdStrike OAuth API app for Splunk SOARto a version that resolves this vulnerability.Fixed in 5.1.3
Event History
Frequently Asked Questions
Who can expose the sensitive document password?
A user with a Splunk SOAR role that has permission to run actions can expose it by invoking the affected detonate file or detonate url action.
Which deployments are affected?
Versions of the CrowdStrike OAuth API app for Splunk SOAR below 5.1.3 are affected. The issue applies when the affected actions are used with the document_password parameter.
What should be done if the app cannot be updated immediately?
Restrict permission to run actions for users who do not need to invoke the detonate file or detonate url actions, and avoid supplying sensitive document passwords through the affected parameter where possible.
How can an organization determine whether a password may have been exposed?
Review use of the detonate file and detonate url actions in affected app versions, especially executions that supplied document_password. In vulnerable versions, that parameter is displayed in cleartext in the user interface.