CVE-2026-76384: Information Disclosure through Action Parameters in Splunk Attack Analyzer Connector for Splunk SOAR
In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking either the detonate file or detonate url action, because the action's archivepassword parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Attack Analyzer Connector for Splunk SOARto a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
Who can expose the archive password?
Any user assigned a role with permission to run actions can expose it by invoking the detonate file or detonate url action. The password is displayed in cleartext in the user interface.
Which configurations are affected?
The issue affects Splunk Attack Analyzer Connector for Splunk SOAR versions below 2.2.1 when the affected actions use the archive_password parameter. The parameter is not marked as a password, so it is not masked.
How can I determine whether the connector is affected?
Check the installed connector version and whether users can run the detonate file or detonate url actions. Versions below 2.2.1 are affected, and invoking either action can reveal an archive_password value in the interface.