CVE-2026-76376: AWS IAM App for Splunk SOAR Disclosure Flaw

CVE-2026-76376 Overview

CVE-2026-76376 is an information disclosure vulnerability in the AWS IAM app for Splunk SOAR versions below 2.1.9. The app fails to mark the credentials action parameter as a password field. As a result, sensitive AWS credentials appear in cleartext within the Splunk SOAR user interface when a user runs an action that accepts this parameter.

Any authenticated user holding a role with permission to run actions can trigger the exposure. The flaw is classified under CWE-312: Cleartext Storage of Sensitive Information.

Critical Impact
Authenticated Splunk SOAR users with action-execution privileges can view AWS IAM credentials in cleartext through the UI, enabling lateral movement into connected AWS environments.

Affected Products

Splunk SOAR AWS IAM app versions prior to 2.1.9
Splunk SOAR on-premises deployments running the affected app
Splunk SOAR Cloud deployments running the affected app

Discovery Timeline

2026-08-19 - CVE-2026-76376 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76376

Vulnerability Analysis

The AWS IAM app for Splunk SOAR exposes an action that accepts a credentials parameter for authenticating against AWS services. Splunk SOAR renders action parameters in the web interface based on how the app declares them in its configuration schema. Parameters marked as password type are masked; all others render in cleartext.

In versions below 2.1.9, the credentials parameter is declared without the password type designation. When any user with the required role executes the action, the AWS credentials appear in cleartext on the action results and history views. Other Splunk SOAR users viewing the same action history inherit that visibility.

Credentials disclosed through this path can be reused outside the SOAR environment. Exposed AWS access keys enable an attacker to enumerate IAM permissions, escalate privileges within the connected AWS account, or exfiltrate data from S3 and other services.

Root Cause

The root cause is a missing parameter type declaration in the app's action configuration. The app author did not mark the credentials field as sensitive, so Splunk SOAR's UI treats it as a standard string and renders it in plaintext across UI surfaces and action logs.

Attack Vector

Exploitation requires network access to the Splunk SOAR interface and a valid account with role permissions to run actions or view action history. An attacker with these prerequisites can invoke the vulnerable AWS IAM action, supply or observe the credentials parameter, and read AWS keys directly from the UI without any additional exploitation tooling.

The vulnerability requires no user interaction from a victim and no elevated privileges beyond the action-run permission. Refer to the Splunk Security Advisory SVD-2026-0806 for full technical details.

Detection Methods for CVE-2026-76376

Indicators of Compromise

Splunk SOAR audit log entries showing execution of AWS IAM app actions that include the credentials parameter.
Unexpected AWS CloudTrail activity originating from IAM access keys that were passed through the SOAR UI.
Access to action result pages or playbook run history containing plaintext AWS access key IDs (format AKIA* or ASIA*).

Detection Strategies

Inventory installed Splunk SOAR apps and verify the AWS IAM app version. Any version below 2.1.9 is vulnerable.
Review Splunk SOAR audit logs for historical invocations of AWS IAM actions where the credentials parameter was populated inline rather than via an asset configuration.
Correlate SOAR action runs with AWS CloudTrail GetCallerIdentity, ListUsers, and CreateAccessKey events to identify potential credential misuse.

Monitoring Recommendations

Enable and forward Splunk SOAR audit logs to a centralized data lake for retention and query.
Monitor AWS CloudTrail for API calls made from source IPs that do not match your SOAR infrastructure using keys previously handled by SOAR.
Alert on any Splunk SOAR role assignment that grants run action permission to accounts outside the SOC operations group.

How to Mitigate CVE-2026-76376

Immediate Actions Required

Upgrade the AWS IAM app for Splunk SOAR to version 2.1.9 or later on all SOAR instances.
Rotate any AWS IAM access keys that were passed as inline action parameters through the vulnerable app version.
Audit Splunk SOAR user roles and remove run action permissions from accounts that do not require them.

Patch Information

Splunk has released a fixed version of the AWS IAM app for Splunk SOAR in version 2.1.9. The patch marks the credentials parameter as a password type so the UI masks its value. See Splunk Security Advisory SVD-2026-0806 for the official fix details and download.

Workarounds

Configure AWS credentials through the app's asset configuration instead of passing them as inline action parameters, so credentials are stored in Splunk SOAR's encrypted secrets store rather than displayed in action UI.
Restrict the run action role permission to a minimal set of trusted operators until the upgrade is applied.
Use short-lived AWS session tokens (STS) instead of long-lived access keys to limit the window of exposure if credentials leak.

bash

# Verify installed AWS IAM app version on Splunk SOAR
phenv python -c "import json; \
  import os; \
  p='/opt/phantom/apps/awsiam'; \
  print(json.load(open(os.path.join(p,'awsiam.json')))['app_version'])"

# Upgrade the app via the Splunk SOAR UI:
# Home > Apps > Search 'AWS IAM' > Update to 2.1.9 or later