CVE-2026-76381 Overview
CVE-2026-76381 is an information disclosure vulnerability in the MS Graph for Active Directory app for Splunk SOAR in versions below 1.5.2. The app fails to mark the temp_password parameter of the reset password action as a password field. As a result, any user with a role permitted to run actions can view the temporary password in cleartext through the user interface. The flaw is tracked under CWE-312: Cleartext Storage of Sensitive Information.
Critical Impact
Authenticated Splunk SOAR users with action-run permissions can view Active Directory temporary passwords in cleartext, enabling potential account takeover of reset targets.
Affected Products
- MS Graph for Active Directory app for Splunk SOAR versions below 1.5.2
- Splunk SOAR (on-premises) deployments running the affected app
- Splunk SOAR Cloud deployments running the affected app
Discovery Timeline
- 2026-08-19 - CVE-2026-76381 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76381
Vulnerability Analysis
The MS Graph for Active Directory app exposes a reset password action that generates or accepts a temporary password used to reset an Active Directory account. The action definition in the affected app versions does not classify the temp_password parameter as a password type. Splunk SOAR uses the parameter type to determine whether to mask input and output in the user interface. Because the parameter is treated as a normal string, the temporary password renders in cleartext in action run views, activity history, and related audit displays.
Any SOAR user assigned a role with permission to run actions can trigger the reset password action and observe the resulting cleartext credential. The credential can then be used to authenticate as the reset target until a legitimate password change occurs.
Root Cause
The root cause is a missing parameter classification in the app's action metadata. Splunk SOAR relies on the data_type or equivalent flag on action parameters to enforce credential masking. Marking temp_password as a password-type parameter would cause the UI to redact the value. The app maintainers omitted this designation, leaving sensitive material visible alongside non-sensitive action inputs.
Attack Vector
Exploitation requires an authenticated Splunk SOAR user with a role that grants permission to execute actions on the MS Graph for Active Directory app. The attacker invokes the reset password action against a target Active Directory account, either directly through the UI or via a playbook. The resulting temporary password appears in cleartext in the action result view. The attacker uses that password to authenticate to the target account through Entra ID or on-premises Active Directory. The vector is network-based and requires no user interaction from the victim.
For procedural context on invoking actions, see Run an action in Splunk SOAR.
Detection Methods for CVE-2026-76381
Indicators of Compromise
- Execution of the reset password action from the MS Graph for Active Directory app by users outside a defined identity-operations role.
- Successful Active Directory or Entra ID sign-ins to accounts immediately after a SOAR reset password action completes.
- Unexpected password reset activity recorded in Microsoft Graph audit logs correlated to SOAR service principal calls.
Detection Strategies
- Review Splunk SOAR audit logs for invocations of the reset password action and cross-reference against approved playbooks and users.
- Correlate SOAR action logs with Entra ID sign-in logs to identify authentications using recently reset credentials.
- Alert on any run of the MS Graph for Active Directory reset password action outside change-window hours.
Monitoring Recommendations
- Ingest SOAR audit and action-result logs into a central SIEM for long-term retention and correlation.
- Monitor Microsoft Graph service principal activity for password reset operations that lack a matching approved ticket.
- Track privileged Active Directory account usage after any password reset event triggered from SOAR.
How to Mitigate CVE-2026-76381
Immediate Actions Required
- Upgrade the MS Graph for Active Directory app for Splunk SOAR to version 1.5.2 or later.
- Audit SOAR role assignments and remove action-run permissions from users who do not require them.
- Rotate any Active Directory or Entra ID account passwords that were reset using the affected app while the vulnerability was present.
Patch Information
Splunk has released version 1.5.2 of the MS Graph for Active Directory app, which classifies the temp_password parameter as a password field so that its value is masked in the user interface. Refer to the Splunk Security Advisory SVD-2026-0806 for complete remediation guidance and download instructions.
Workarounds
- Restrict the reset password action to a small, dedicated identity-operations role until the app is upgraded.
- Disable or remove the reset password action from playbooks accessible by general SOAR users.
- Require immediate forced password change on any target account whose temporary password is set through SOAR.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
