CVE-2026-76380: CrowdStrike SOAR Password Disclosure Flaw

CVE-2026-76380 Overview

CVE-2026-76380 is an information disclosure vulnerability in the CrowdStrike OAuth API app for Splunk SOAR. Versions below 5.1.3 fail to mask the document_password parameter when a user invokes the detonate file or detonate url action. The parameter renders in cleartext in the user interface because the app does not mark it as a password field. Any authenticated user with permission to run actions can view the sensitive password value. This weakness is classified under CWE-312: Cleartext Storage of Sensitive Information.

Critical Impact
Authenticated SOAR users with action-run privileges can read sensitive document passwords in cleartext through the action user interface, enabling credential exposure and potential lateral misuse.

Affected Products

CrowdStrike OAuth API app for Splunk SOAR versions below 5.1.3
Splunk SOAR (On-Premises) deployments running the affected app
Splunk SOAR Cloud deployments running the affected app

Discovery Timeline

2026-08-19 - CVE-2026-76380 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76380

Vulnerability Analysis

The CrowdStrike OAuth API app extends Splunk SOAR with actions that submit files or URLs for detonation in a sandbox. Both the detonate file and detonate url actions accept an optional document_password parameter used to open protected documents inside the sandbox. In affected versions, the app's action definition does not flag document_password as sensitive, so the SOAR web interface treats it as a normal string. The value is displayed in cleartext when the action is configured, executed, or reviewed in the activity log.

A user assigned any role that permits running these actions can read the password directly from the browser without needing elevated privileges. Because SOAR playbooks and analyst workflows commonly reuse document passwords across cases, exposure of one value can compromise related investigations. The vulnerability does not allow modification of data or denial of service; the impact is limited to confidentiality of the parameter.

Root Cause

The root cause is a missing attribute in the app's action parameter definition. Splunk SOAR relies on parameter metadata to determine whether an input should be masked in the user interface and redacted from logs. The affected app omits the password type designation for document_password, which causes the framework to render and store it as plain text. This is a design and configuration flaw rather than a memory safety or injection issue.

Attack Vector

Exploitation requires an authenticated Splunk SOAR user who holds a role with permission to execute the detonate file or detonate url action. The attacker navigates to the action run interface, inspects an action that was previously configured with a document_password, and reads the value from the field or the action result view. No network-level exploitation, malformed input, or code execution is required. Shared analyst environments and multi-tenant SOAR deployments increase the exposure surface.

No verified proof-of-concept code has been published. Refer to the Splunk Security Advisory SVD-2026-0806 for vendor technical details.

Detection Methods for CVE-2026-76380

Indicators of Compromise

Splunk SOAR audit records showing detonate file or detonate url action executions by users outside the expected incident response group
Presence of cleartext values in the document_password parameter of stored action runs within the CrowdStrike OAuth API app
Installed CrowdStrike OAuth API app version reporting below 5.1.3 in the SOAR app management view

Detection Strategies

Query the SOAR platform for the installed version of the CrowdStrike OAuth API app and flag any instance below 5.1.3
Review action run history for detonate file and detonate url invocations and identify entries where document_password was supplied
Correlate role assignments with action execution privileges to identify users who could have viewed exposed passwords

Monitoring Recommendations

Enable and centralize Splunk SOAR audit logging, then forward events to a SIEM for retention and correlation
Alert on new role grants that add action-run permissions on the affected app
Track app upgrade events to confirm remediation across all SOAR tenants

How to Mitigate CVE-2026-76380

Immediate Actions Required

Upgrade the CrowdStrike OAuth API app for Splunk SOAR to version 5.1.3 or later on all SOAR instances
Rotate any document passwords that were previously entered into the detonate file or detonate url actions
Audit user roles and remove action-run permissions from accounts that do not require them

Patch Information

Splunk released a fixed version of the CrowdStrike OAuth API app that marks document_password as a password parameter, ensuring the value is masked in the user interface and handled as sensitive. Apply version 5.1.3 or later as documented in the Splunk Security Advisory SVD-2026-0806.

Workarounds

Restrict the roles permitted to run the affected detonate file and detonate url actions until the app is upgraded
Avoid supplying document passwords through the affected actions; process protected documents out of band where feasible
Purge historical action results that contain cleartext passwords from the SOAR database after rotation

bash

# Verify the installed app version in Splunk SOAR (on-premises)
phenv python -c "import json,glob,os; \
  paths = glob.glob('/opt/phantom/apps/*crowdstrike*oauth*/*.json'); \
  [print(os.path.basename(os.path.dirname(p)), json.load(open(p)).get('app_version')) for p in paths]"