CVE-2026-76378 Overview
CVE-2026-76378 is an information disclosure vulnerability in the Cisco Secure Malware Analytics app for Splunk SOAR, affecting versions below 2.4.5. The app fails to mask the sample_password parameter of the detonate file action, exposing the value in cleartext within the user interface. Any authenticated user assigned a role with permission to run actions can trigger the disclosure. The flaw is tracked under [CWE-312: Cleartext Storage of Sensitive Information]. Splunk documented the issue in Splunk Security Advisory SVD-2026-0806.
Critical Impact
Authenticated SOAR users with action-execution privileges can view sensitive sample passwords in cleartext, enabling credential leakage to any operator with access to the action interface.
Affected Products
- Cisco Secure Malware Analytics app for Splunk SOAR versions below 2.4.5
- Splunk SOAR deployments with the affected app installed
- Splunk SOAR On-Premises environments running the vulnerable integration
Discovery Timeline
- 2026-08-19 - CVE-2026-76378 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76378
Vulnerability Analysis
The Cisco Secure Malware Analytics app for Splunk SOAR provides a detonate file action that submits samples for analysis. The action accepts a sample_password parameter used when detonating password-protected archives or samples. The app declares this parameter as a standard string field rather than a password field, causing the SOAR platform to render its value in cleartext.
When an operator runs the action from the Splunk SOAR interface, the parameter and its value are displayed in the action results and audit views. Any SOAR user whose role permits running actions can observe the password. This exposes secrets that should remain confidential to the submitter and to downstream sandbox systems.
Root Cause
The root cause is a metadata declaration error in the app manifest. Splunk SOAR relies on action parameter definitions to determine which inputs must be masked. Because the sample_password field is not marked with the password data type, the platform treats it as plain text throughout its rendering and logging pipeline. This maps directly to [CWE-312], where sensitive data is stored or displayed without protective handling.
Attack Vector
Exploitation requires an authenticated SOAR account with permission to execute actions. The attacker does not need administrative rights or code execution capability. Running or observing the detonate file action against any sample with a sample_password value reveals the cleartext value in the UI. The vulnerability does not affect integrity or availability, only confidentiality of the parameter value.
No verified public exploit code is available. The mechanism is described in Splunk Security Advisory SVD-2026-0806 and Splunk's documentation on running an action in Splunk SOAR.
Detection Methods for CVE-2026-76378
Indicators of Compromise
- Execution records of the detonate file action in the Cisco Secure Malware Analytics app where sample_password appears in plaintext within action results.
- SOAR audit log entries showing action parameter values captured without masking.
- User activity patterns where non-submitting operators view action results containing sample credentials.
Detection Strategies
- Query Splunk SOAR audit logs for invocations of the detonate file action and inspect whether sample_password values appear in stored parameter data.
- Enumerate roles with action-execution permissions and review which users can view historical action results.
- Correlate SOAR user session activity with access to actions that contain sensitive parameters.
Monitoring Recommendations
- Alert on any read access to detonate file action results by users other than the original submitter.
- Monitor for installations of the Cisco Secure Malware Analytics app at versions below 2.4.5 across managed Splunk SOAR instances.
- Track privilege changes that grant action-execution roles to additional users while the vulnerable app version is deployed.
How to Mitigate CVE-2026-76378
Immediate Actions Required
- Upgrade the Cisco Secure Malware Analytics app for Splunk SOAR to version 2.4.5 or later on all Splunk SOAR instances.
- Rotate any sample passwords previously supplied through the detonate file action while the vulnerable version was in use.
- Review and restrict roles that grant action-execution permissions to the minimum set of trusted operators.
Patch Information
Splunk released a fixed version of the Cisco Secure Malware Analytics app that correctly declares sample_password as a masked parameter. Administrators should install version 2.4.5 or later from Splunkbase. Full remediation details are published in Splunk Security Advisory SVD-2026-0806.
Workarounds
- Avoid using the detonate file action with a populated sample_password value until the app is upgraded.
- Restrict role assignments so that only vetted analysts hold permission to run actions in Splunk SOAR.
- Purge historical action results that contain exposed sample_password values from the SOAR database and log stores.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
