Monthly
Partial API key exposure in Splunk On-Call (VictorOps) app versions below 1.0.43 allows any authenticated Splunk user - regardless of role - to read a partially masked VictorOps API key from the App Key Value Store (KV Store). The app fails to fully mask the API key prior to persisting it in a KV Store collection that is readable by low-privileged users who do not hold the 'admin' or 'power' Splunk roles, violating the principle of least-privilege for credential storage. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the CVSS score of 4.3 aligns with the limited, partial credential exposure.
Cleartext exposure of Zoom meeting passwords in the Splunk SOAR interface affects all deployments running the Zoom app for Splunk SOAR below version 3.2.2. Any authenticated SOAR user holding a role with permission to run actions can invoke the create meeting, update meeting, or update user settings actions and observe meeting passwords and personal meeting ID (PMI) passwords in plaintext within the SOAR UI. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cleartext credential exposure in Venafi app for Splunk SOAR versions below 2.1.4 allows any authenticated user with action-run permissions to read keystore and private-key passwords directly from the Splunk SOAR user interface. The root cause is that the app's `keystore_password` and `password` parameters in the 'get certificate' action are not flagged as password-type fields, bypassing the SOAR platform's native masking mechanism. No public exploit code identified at time of analysis, and there is no CISA KEV listing; however, the exposed credentials could enable downstream PKI compromise if observed by a malicious insider.
Cleartext exposure of archive passwords in Splunk Attack Analyzer Connector for Splunk SOAR (versions below 2.2.1) allows authenticated users with action-running permissions to view sensitive archive_password values unmasked in the SOAR user interface. The connector's detonate file and detonate url actions fail to mark the archive_password parameter as a password type, causing the SOAR framework to render it in plaintext during and after action execution. No active exploitation has been identified - the CVE carries no CISA KEV listing and no known public exploit code - but insider or compromised-account exposure is straightforward for any SOAR user with the relevant role.
Information disclosure in the RSA SecurID Authentication Manager app for Splunk SOAR (versions below 1.0.5) exposes RSA token serial numbers in cleartext to any authenticated user with action-run permissions. The app's 'enable token' and 'revoke token' actions fail to mark the token_serial parameter as a password field, causing it to render unmasked in the Splunk SOAR user interface. No public exploit has been identified at time of analysis, and exploitation is constrained by the requirement for an existing Splunk SOAR account with action-execution privileges.
Cleartext exposure of archive passwords in Splunk SOAR's Phantom app (versions below 3.8.5) allows authenticated users with action-running permissions to read sensitive credentials directly from the platform's user interface. The deflate item action fails to mark its password parameter as a sensitive field, causing the archive password to be rendered in plaintext in the SOAR UI to any user who invokes the action. Splunk has released a patch in version 3.8.5 per advisory SVD-2026-0806; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext exposure of temporary Active Directory passwords in the MS Graph for Active Directory app for Splunk SOAR (versions below 1.5.2) allows authenticated users with action-run permissions to capture credentials generated during password reset operations, as the temp_password parameter is rendered in plaintext in the SOAR interface rather than being masked. The flaw stems from the app failing to declare the affected parameter as a password type, causing the Splunk SOAR UI to treat it as generic text output. No active exploitation has been confirmed and no public POC is reported; risk is bounded by the requirement for an authenticated internal SOAR account with specific action-run role permissions.
Cleartext exposure of document passwords in the CrowdStrike OAuth API app for Splunk SOAR (versions below 5.1.3) allows any authenticated user with action-running permissions to read sensitive document_password values directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the document_password parameter as a password type in both the detonate file and detonate url actions, meaning the platform's built-in masking mechanism is never invoked. Vendor patch version 5.1.3 has been released and confirmed via Splunk advisory SVD-2026-0806; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in the Cisco Webex App for Splunk SOAR (versions below 2.2.1) exposes Webex meeting passwords in cleartext within the SOAR platform interface. Authenticated users holding roles with action-execution permissions who invoke the 'schedule meeting' action can read the plaintext meeting password directly from the UI, because the app's action manifest fails to designate the password parameter as a masked field. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known; real-world impact is bounded by the requirement for existing SOAR action permissions.
Cleartext exposure of a sensitive sample password in the Cisco Secure Malware Analytics App for Splunk SOAR (versions below 2.4.5) allows authenticated users with action-run permissions to read the sample_password parameter value directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the sample_password field as a password type in the detonate file action, meaning the platform never applies its standard masking behavior to that parameter. No public exploit code or active exploitation has been identified; vendor patch is available at version 2.4.5.
Partial API key exposure in Splunk On-Call (VictorOps) app versions below 1.0.43 allows any authenticated Splunk user - regardless of role - to read a partially masked VictorOps API key from the App Key Value Store (KV Store). The app fails to fully mask the API key prior to persisting it in a KV Store collection that is readable by low-privileged users who do not hold the 'admin' or 'power' Splunk roles, violating the principle of least-privilege for credential storage. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the CVSS score of 4.3 aligns with the limited, partial credential exposure.
Cleartext exposure of Zoom meeting passwords in the Splunk SOAR interface affects all deployments running the Zoom app for Splunk SOAR below version 3.2.2. Any authenticated SOAR user holding a role with permission to run actions can invoke the create meeting, update meeting, or update user settings actions and observe meeting passwords and personal meeting ID (PMI) passwords in plaintext within the SOAR UI. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cleartext credential exposure in Venafi app for Splunk SOAR versions below 2.1.4 allows any authenticated user with action-run permissions to read keystore and private-key passwords directly from the Splunk SOAR user interface. The root cause is that the app's `keystore_password` and `password` parameters in the 'get certificate' action are not flagged as password-type fields, bypassing the SOAR platform's native masking mechanism. No public exploit code identified at time of analysis, and there is no CISA KEV listing; however, the exposed credentials could enable downstream PKI compromise if observed by a malicious insider.
Cleartext exposure of archive passwords in Splunk Attack Analyzer Connector for Splunk SOAR (versions below 2.2.1) allows authenticated users with action-running permissions to view sensitive archive_password values unmasked in the SOAR user interface. The connector's detonate file and detonate url actions fail to mark the archive_password parameter as a password type, causing the SOAR framework to render it in plaintext during and after action execution. No active exploitation has been identified - the CVE carries no CISA KEV listing and no known public exploit code - but insider or compromised-account exposure is straightforward for any SOAR user with the relevant role.
Information disclosure in the RSA SecurID Authentication Manager app for Splunk SOAR (versions below 1.0.5) exposes RSA token serial numbers in cleartext to any authenticated user with action-run permissions. The app's 'enable token' and 'revoke token' actions fail to mark the token_serial parameter as a password field, causing it to render unmasked in the Splunk SOAR user interface. No public exploit has been identified at time of analysis, and exploitation is constrained by the requirement for an existing Splunk SOAR account with action-execution privileges.
Cleartext exposure of archive passwords in Splunk SOAR's Phantom app (versions below 3.8.5) allows authenticated users with action-running permissions to read sensitive credentials directly from the platform's user interface. The deflate item action fails to mark its password parameter as a sensitive field, causing the archive password to be rendered in plaintext in the SOAR UI to any user who invokes the action. Splunk has released a patch in version 3.8.5 per advisory SVD-2026-0806; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext exposure of temporary Active Directory passwords in the MS Graph for Active Directory app for Splunk SOAR (versions below 1.5.2) allows authenticated users with action-run permissions to capture credentials generated during password reset operations, as the temp_password parameter is rendered in plaintext in the SOAR interface rather than being masked. The flaw stems from the app failing to declare the affected parameter as a password type, causing the Splunk SOAR UI to treat it as generic text output. No active exploitation has been confirmed and no public POC is reported; risk is bounded by the requirement for an authenticated internal SOAR account with specific action-run role permissions.
Cleartext exposure of document passwords in the CrowdStrike OAuth API app for Splunk SOAR (versions below 5.1.3) allows any authenticated user with action-running permissions to read sensitive document_password values directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the document_password parameter as a password type in both the detonate file and detonate url actions, meaning the platform's built-in masking mechanism is never invoked. Vendor patch version 5.1.3 has been released and confirmed via Splunk advisory SVD-2026-0806; no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in the Cisco Webex App for Splunk SOAR (versions below 2.2.1) exposes Webex meeting passwords in cleartext within the SOAR platform interface. Authenticated users holding roles with action-execution permissions who invoke the 'schedule meeting' action can read the plaintext meeting password directly from the UI, because the app's action manifest fails to designate the password parameter as a masked field. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known; real-world impact is bounded by the requirement for existing SOAR action permissions.
Cleartext exposure of a sensitive sample password in the Cisco Secure Malware Analytics App for Splunk SOAR (versions below 2.4.5) allows authenticated users with action-run permissions to read the sample_password parameter value directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the sample_password field as a password type in the detonate file action, meaning the platform never applies its standard masking behavior to that parameter. No public exploit code or active exploitation has been identified; vendor patch is available at version 2.4.5.