CrowdStrike OAuth API App CVE-2026-76380

Exploitation requires an authenticated Splunk SOAR session with a role that grants permission to run or view actions - this is a non-default, explicitly assigned role. The vulnerability is only triggered when the 'detonate file' or 'detonate url' actions are invoked with a non-empty document_password parameter value; if those actions are not used or no document password is supplied, no sensitive information is exposed. Exploitation is further limited to SOAR deployments running the CrowdStrike OAuth API app below version 5.1.3. Factors limiting risk beyond the CVSS score: the attacker must already possess valid SOAR credentials with action-running rights; only the document_password value (not broader credentials or session tokens) is disclosed; and exposure is confined to the Splunk SOAR UI and its action logs rather than any external channel.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a moderate, authenticated information disclosure with limited blast radius - only the document_password value is exposed, not credentials to broader systems. No EPSS score was provided in the source data, and the vulnerability has not been added to the CISA KEV catalog, consistent with its constrained exploitability (attacker must already hold a valid Splunk SOAR account with action-running rights). There is no public proof-of-concept code identified at time of analysis. Practically, even a mid-sized municipal IT team in swidnica running this integration should treat this as a medium-priority patch - the information leaked is scoped to detonation document passwords, but in sandbox workflows those passwords may also protect sensitive analyst-submitted samples. The primary real-world risk is insider threat or a compromised low-privilege SOAR account being leveraged to harvest document passwords, which may unlock malware samples or confidential files submitted for analysis.

An analyst or adversary holding a Splunk SOAR account with the action-running permission authenticates to the SOAR web interface and navigates to a recent or in-progress detonate file or detonate url action run. Because the document_password field is not masked, its value is displayed in cleartext in the action parameter view, allowing the user to harvest the password without any elevated privilege or special tooling. No proof-of-concept code exists, and exploitation requires only normal platform UI interaction.