CVE-2026-76385: Information Disclosure through Action Parameters in Venafi app for Splunk SOAR
In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystorepassword and password parameters are not masked and are shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameters as passwords. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Venafi app for Splunk SOARto a version that resolves this vulnerability.Fixed in 2.1.4
Event History
Frequently Asked Questions
Who can exploit this issue?
A Splunk SOAR user with a role permitted to run actions can expose the affected credentials. No additional user interaction is required.
Which credentials can be disclosed?
The get certificate action can display its keystore_password and password parameters in cleartext in the user interface, potentially exposing keystore and private-key passwords.
Which deployments are affected?
Venafi app for Splunk SOAR versions below 2.1.4 are affected. The issue occurs when users invoke the get certificate action because its affected parameters are not marked as passwords.