CVE-2026-76374: Splunk SOAR Information Disclosure Flaw

CVE-2026-76374 Overview

CVE-2026-76374 affects the Active Directory Lightweight Directory Access Protocol (AD LDAP) app for Splunk SOAR in versions below 2.3.8. An authenticated user holding a role permitted to run actions can trigger write operations that cause sensitive Active Directory response data to be persisted to a debug log file. The issue is categorized under [CWE-532: Insertion of Sensitive Information into Log File]. Because the data is written to persistent storage, any user or process with access to the log file can read directory content that should remain restricted to authorized queries.

Critical Impact
An authenticated SOAR user with action-run permissions can cause sensitive Active Directory data to be written to a persistent debug log, exposing directory information to anyone with log access.

Affected Products

Splunk SOAR AD LDAP app versions below 2.3.8
Splunk SOAR on-premises deployments using the AD LDAP app
Splunk SOAR Cloud deployments using the AD LDAP app

Discovery Timeline

2026-08-19 - CVE-2026-76374 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76374

Vulnerability Analysis

The AD LDAP app for Splunk SOAR integrates with Active Directory to run automated actions such as querying user objects, resetting passwords, and modifying group membership. In versions prior to 2.3.8, the app writes Active Directory response data to a debug log when write operations are triggered. This log is persistent, meaning the sensitive content is retained beyond the lifetime of the playbook or action execution.

An authenticated user who holds a role with permission to run actions can invoke write operations through the app. The response data returned by Active Directory is then serialized into the debug log file. The confidentiality impact is limited but non-trivial because directory attributes may include user identifiers, group memberships, and other organizational metadata.

Root Cause

The root cause is improper log hygiene in the AD LDAP connector. Sensitive response content is emitted at debug verbosity without redaction or sanitization. [CWE-532] describes this class of defect: data intended for transient use is preserved in log artifacts that outlive the operation. The vulnerability does not enable modification or denial of service.

Attack Vector

Exploitation requires network access to the Splunk SOAR instance and valid credentials with a role that permits action execution. The attacker triggers a write action through the AD LDAP app, then retrieves the persistent debug log through any available mechanism. No user interaction is required beyond the initial authenticated action invocation. Refer to the Splunk Security Advisory SVD-2026-0806 for vendor technical details.

Detection Methods for CVE-2026-76374

Indicators of Compromise

Presence of Active Directory attribute data such as sAMAccountName, memberOf, or distinguishedName values inside AD LDAP app debug log files
Repeated invocation of AD LDAP write actions from a single SOAR user account within a short time window
Access to SOAR debug log files by accounts that do not routinely perform troubleshooting

Detection Strategies

Audit SOAR action history for AD LDAP write actions and correlate against the user role that invoked them
Inspect debug log files produced by the AD LDAP app for directory response content and treat matches as exposure events
Alert on read access to SOAR log directories by non-administrative principals

Monitoring Recommendations

Forward Splunk SOAR audit logs and AD LDAP app logs to a central analytics platform for retention and search
Monitor role assignments that grant action-run permissions and flag additions to those roles
Track file integrity and access events on the SOAR host directories that store app debug logs

How to Mitigate CVE-2026-76374

Immediate Actions Required

Upgrade the AD LDAP app for Splunk SOAR to version 2.3.8 or later on all SOAR instances
Review and rotate any Active Directory credentials or tokens that may have been exposed in historical debug logs
Purge existing debug log files that contain AD LDAP response data after collecting them for forensic review

Patch Information

Splunk has released AD LDAP app version 2.3.8, which addresses the logging behavior. Administrators should install the fixed version from Splunkbase and validate the update across all SOAR nodes. Full remediation guidance is available in the Splunk Security Advisory SVD-2026-0806.

Workarounds

Restrict the SOAR roles that grant permission to run AD LDAP write actions to a minimal set of trusted operators
Restrict filesystem access to SOAR log directories so only administrators can read app debug logs
Disable debug-level logging for the AD LDAP app until the upgrade to version 2.3.8 is complete

bash

# Example: restrict access to SOAR log directory on the SOAR host
sudo chown -R root:phantom /opt/phantom/var/log/phantom
sudo chmod -R 750 /opt/phantom/var/log/phantom

# Verify AD LDAP app version installed on SOAR
phenv python -c "import phantom_apps; print(phantom_apps.get_version('ad_ldap'))"