CVE-2026-76375: Splunk SOAR Information Disclosure Flaw

CVE-2026-76375 Overview

CVE-2026-76375 affects the Active Directory Lightweight Directory Access Protocol (AD LDAP) app for Splunk SOAR in versions below 2.3.8. A user holding a role with permission to run actions can trigger the connector to write its full process environment to a persistent debug log file in plaintext. Because the process environment contains configured credentials, this exposes sensitive authentication material to any party with access to the debug log. The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File).

Critical Impact
An authenticated SOAR user with action-execution privileges can cause the AD LDAP connector to persist plaintext credentials to a debug log, enabling downstream credential theft.

Affected Products

Splunk SOAR AD LDAP app versions below 2.3.8
Splunk SOAR On-Premises deployments running the vulnerable app
Splunk SOAR Cloud deployments running the vulnerable app

Discovery Timeline

2026-08-19 - CVE-2026-76375 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76375

Vulnerability Analysis

The AD LDAP app for Splunk SOAR executes as a connector process that receives its configuration, including credential material, through environment variables. When an authorized user invokes an action against this connector, the app writes the complete process environment into a debug log file on disk. The write is persistent and occurs in plaintext, meaning the credentials remain readable long after the action completes.

The issue falls under CWE-532: Insertion of Sensitive Information into Log File. Exploitation requires only an authenticated SOAR account with the standard permission to run actions, which is a common privilege level within a SOAR deployment.

The scope-changed impact reflects that credentials logged by the AD LDAP connector may grant access to Active Directory resources beyond the SOAR system itself. An attacker who reads the log can pivot into the domain using the exposed service account.

Root Cause

The root cause is unsafe diagnostic logging inside the AD LDAP connector. The connector serializes its entire environment variable set into the debug log without redacting fields that hold secrets. Because SOAR passes asset configuration, including bind DNs and passwords, through the environment, those values land in the log verbatim.

Attack Vector

An authenticated user with the action-run permission selects the AD LDAP asset and invokes any supported action. The action triggers the connector to write the debug log entry containing credentials. The attacker then retrieves the log file through any mechanism that grants access to SOAR debug logs, such as the file system, log aggregation, or backup storage.

No public exploit code or proof-of-concept is available. Refer to the Splunk Security Advisory SVD-2026-0806 for vendor-supplied technical details.

Detection Methods for CVE-2026-76375

Indicators of Compromise

Presence of AD LDAP connector debug log entries that contain environment variable dumps with credential-like strings such as bind DN, password, or token fields.
Unexpected read access to Splunk SOAR debug log directories by accounts that do not perform routine log review.
Post-exploitation Active Directory authentication events originating from hosts outside the normal SOAR infrastructure using the AD LDAP service account.

Detection Strategies

Audit installed versions of the AD LDAP app on all Splunk SOAR instances and flag any version below 2.3.8.
Review historical SOAR debug logs for plaintext credential material and treat any hit as a credential exposure incident.
Correlate SOAR action-execution events with subsequent AD authentication anomalies for the credentials configured on the AD LDAP asset.

Monitoring Recommendations

Enable file integrity monitoring on Splunk SOAR log directories to alert on access by non-administrative accounts.
Monitor Active Directory for anomalous logons using the bind account configured in the AD LDAP asset, especially from unexpected source hosts.
Track SOAR role assignments and alert when the run-action permission is granted to new users or roles.

How to Mitigate CVE-2026-76375

Immediate Actions Required

Upgrade the AD LDAP app for Splunk SOAR to version 2.3.8 or later on all SOAR instances.
Rotate every credential configured in AD LDAP assets, treating them as potentially disclosed.
Restrict access to SOAR debug log directories and purge historical debug logs after review.
Review and tighten SOAR role assignments so that the run-action permission is limited to necessary users.

Patch Information

Splunk has addressed the issue in AD LDAP app version 2.3.8. Full remediation details are available in the Splunk Security Advisory SVD-2026-0806.

Workarounds

Disable the AD LDAP app on Splunk SOAR until the upgrade to 2.3.8 or later is applied.
Reduce membership of roles that hold the run-action permission to the minimum required set of users.
Configure the AD LDAP asset with a service account that has the least Active Directory privilege necessary for required actions.

bash

# Configuration example: verify installed AD LDAP app version on Splunk SOAR
phenv python -c "import phantom_app_ad_ldap, sys; sys.stdout.write(getattr(phantom_app_ad_ldap, '__version__', 'unknown'))"

# Restrict access to SOAR debug log directory (adjust path to your install)
chown -R phantom:phantom /opt/phantom/var/log
chmod -R 750 /opt/phantom/var/log