EUVD-2026-62947
GHSA-2289-x8cm-qhf2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible UI (AV:N), requires authenticated action-running role (PR:L), only low confidentiality impact from password exposure, no integrity or availability effect.
Primary rating from Vendor (cisco).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
In versions below 3.8.5 of the Phantom app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking the deflate item action, because the action's password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
AnalysisAI
Cleartext exposure of archive passwords in Splunk SOAR's Phantom app (versions below 3.8.5) allows authenticated users with action-running permissions to read sensitive credentials directly from the platform's user interface. The deflate item action fails to mark its password parameter as a sensitive field, causing the archive password to be rendered in plaintext in the SOAR UI to any user who invokes the action. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated session in Splunk SOAR and a user role that has been explicitly granted the 'run actions' permission. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 medium score is proportionate to the actual risk profile: exploitation requires an already-authenticated session with a role that holds explicit action-running permissions, and the only confirmed impact is low confidentiality loss (C:L) with no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated SOAR user holding an action-running role navigates to the Phantom app's deflate item action, invokes it against a target archive, and reads the archive password displayed in cleartext in the action parameter panel. The attacker records the credential and uses it outside the SOAR platform to decrypt archived files containing sensitive security telemetry or forensic evidence. … |
| Remediation | Upgrade the Phantom app for Splunk SOAR to version 3.8.5 or later as directed by Splunk advisory SVD-2026-0806 at https://advisory.splunk.com/advisories/SVD-2026-0806; this release marks the deflate item action's password parameter as a sensitive field, enabling the platform's built-in masking behavior. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today