CVE-2026-76382 Overview
CVE-2026-76382 is an information disclosure vulnerability in the Phantom app for Splunk SOAR in versions below 3.8.5. An authenticated user with permission to run actions can expose a sensitive archive password by invoking the deflate item action. The action's password parameter is not masked and is rendered in cleartext in the user interface, enabling unintended disclosure to observers or lower-privileged reviewers. The weakness maps to CWE-312: Cleartext Storage of Sensitive Information.
Critical Impact
Any Splunk SOAR user with action-execution privileges can capture archive passwords in cleartext through the Phantom app UI, undermining the confidentiality of protected archives.
Affected Products
- Phantom app for Splunk SOAR versions prior to 3.8.5
- Splunk SOAR deployments that install and permit execution of the Phantom app
- Environments where non-administrative roles hold the run-action permission
Discovery Timeline
- 2026-08-19 - CVE-2026-76382 published to the National Vulnerability Database
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76382
Vulnerability Analysis
The Phantom app for Splunk SOAR provides a deflate item action that accepts a password parameter for archive operations. The action definition does not declare this parameter as a password type. As a result, the SOAR user interface displays the value in cleartext rather than masking it with a password field.
An authenticated user with a role permitted to run actions can observe the password when reviewing action history, activity logs, or playbook execution records. The disclosure is confined to confidentiality; the flaw does not enable integrity or availability impact against the SOAR platform itself. However, the exposed archive password may allow decryption of archives that were intended to remain protected from users of that trust level.
Exploitation requires valid SOAR credentials and the run-action permission, and the attack vector is network-based through the SOAR web interface. No user interaction from the victim is required beyond the normal use of the app.
Root Cause
The root cause is a missing parameter type declaration in the Phantom app manifest. Splunk SOAR relies on parameter metadata to determine whether the UI should mask an input. Because the deflate item action does not tag its password argument as a ph password type, SOAR treats it as ordinary text and stores or renders it accordingly.
Attack Vector
An authenticated attacker with the run-action privilege navigates to the Phantom app in Splunk SOAR and initiates the deflate item action. The password field, along with any previously supplied values retained in action history, appears in cleartext. Observers reviewing playbook runs, audit views, or shared consoles can harvest the credential without additional privileges. See the Splunk documentation on running an action in Splunk SOAR for context on how actions are invoked and reviewed.
// No verified proof-of-concept code is published for CVE-2026-76382.
// Refer to the Splunk Security Advisory SVD-2026-0806 for vendor detail.
Detection Methods for CVE-2026-76382
Indicators of Compromise
- Audit log entries showing invocations of the deflate item action within the Phantom app for Splunk SOAR
- Action history records that contain readable password values in the parameters column
- Unexpected access to archive files whose passwords were provided through the affected action
Detection Strategies
- Review Splunk SOAR audit logs for users executing the deflate item action and correlate with role assignments
- Inspect the installed Phantom app version and flag any instance below 3.8.5
- Monitor for role changes that grant run-action permissions to users who do not require them
Monitoring Recommendations
- Enable and forward SOAR audit and activity logs to a central analytics platform for retention and search
- Alert on repeated executions of the deflate item action from non-administrative accounts
- Track archive access patterns to detect use of passwords that may have been observed through the UI
How to Mitigate CVE-2026-76382
Immediate Actions Required
- Upgrade the Phantom app for Splunk SOAR to version 3.8.5 or later
- Rotate any archive passwords that were previously entered into the deflate item action
- Restrict the run-action permission to roles that require it for daily operations
- Review SOAR audit logs to identify users who may have observed exposed passwords
Patch Information
Splunk addressed the issue in Phantom app for Splunk SOAR version 3.8.5. See Splunk Security Advisory SVD-2026-0806 for full remediation guidance and download links.
Workarounds
- Avoid invoking the deflate item action with sensitive passwords until the app is upgraded
- Use pre-encrypted archives or alternative actions that correctly mask credential parameters
- Limit UI access to SOAR consoles from shared workstations and enforce screen-lock policies
# Verify the installed Phantom app version in Splunk SOAR
phenv python -c "import phantom; print(phantom.__version__)"
# List roles that hold the run-action capability for review
phenv rest_call GET /rest/role | jq '.data[] | {name, permissions}'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
