CVE-2026-76383: Information Disclosure through Action Parameters in RSA SecurID Authentication Manager app for Splunk SOAR
In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's tokenserial parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RSA SecurID Authentication Manager app for Splunk SOAR (connector)to a version that resolves this vulnerability.Fixed in 1.0.5 - Compensating control
Ensure the Splunk SOAR platform is upgraded to version 8.6.0 or higher, since the fixed app version requires Splunk SOAR 8.6.0+.
Event History
Frequently Asked Questions
Who can view the exposed token serials?
A user with a role that has permission to run actions can expose a sensitive token serial through the affected actions. The issue is limited to the enable token and revoke token actions.
Which deployments are affected?
Versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR are affected. The disclosure occurs because the token_serial action parameter is displayed in cleartext in the user interface rather than being marked as a password.
How can I determine whether token serials may already have been exposed?
Review use of the enable token and revoke token actions by users permitted to run actions, particularly in versions below 1.0.5. Those action invocations display the token_serial parameter in cleartext in the user interface.