CVE-2026-76383: RSA SecurID Information Disclosure Flaw

CVE-2026-76383 Overview

CVE-2026-76383 is an information disclosure vulnerability in the RSA SecurID Authentication Manager app for Splunk SOAR versions below 1.0.5. The app fails to mask the token_serial parameter used by the enable token and revoke token actions. A user holding a role with permission to run these actions can view the sensitive token serial in cleartext through the Splunk SOAR user interface. The vulnerability is categorized under CWE-312: Cleartext Storage of Sensitive Information and requires authenticated access with action-execution privileges.

Critical Impact
An authenticated Splunk SOAR user with action-run permissions can expose RSA SecurID token serial numbers in cleartext, undermining the confidentiality of multi-factor authentication assets.

Affected Products

RSA SecurID Authentication Manager app for Splunk SOAR, versions below 1.0.5
Splunk SOAR deployments using the affected app version
Any environment where the affected app processes RSA SecurID token operations

Discovery Timeline

2026-08-19 - CVE-2026-76383 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76383

Vulnerability Analysis

The vulnerability resides in how the RSA SecurID Authentication Manager app defines its action parameters within Splunk SOAR. Splunk SOAR uses parameter metadata to determine which values should be masked in the user interface, logs, and command-line output. When a parameter is declared as a password type, the platform obscures the value; otherwise, it renders the value in cleartext.

In versions below 1.0.5, the app does not mark the token_serial parameter for the enable token and revoke token actions as a password. As a result, any user with a role permitted to run these actions can invoke them and observe the token serial in cleartext through the SOAR interface. Token serials identify individual RSA SecurID hardware or software tokens and are considered sensitive within identity infrastructure.

Root Cause

The root cause is an app-level metadata omission. The action definition file for the RSA SecurID Authentication Manager app declares the token_serial field as a standard string parameter rather than as a masked password parameter. Splunk SOAR therefore renders the value in cleartext across action execution views, activity records, and CLI output. This maps directly to CWE-312, where sensitive data is stored or displayed without appropriate protection.

Attack Vector

Exploitation requires an authenticated user with permission to execute actions in Splunk SOAR. The attacker invokes the enable token or revoke token action through the interface or CLI, supplies or observes the token_serial parameter, and reads the cleartext value from the resulting action output. No additional privileges or user interaction are required beyond the standard role assignment. Refer to the Splunk Security Advisory SVD-2026-0806 for vendor-confirmed technical details.

Detection Methods for CVE-2026-76383

Indicators of Compromise

Splunk SOAR audit records showing invocations of the enable token or revoke token actions in the RSA SecurID Authentication Manager app by users who do not own the affected tokens.
Unexpected reads of action results containing token_serial values by low-privilege operator accounts.
Anomalous CLI or API-driven action executions targeting RSA SecurID token workflows outside routine automation playbooks.

Detection Strategies

Review Splunk SOAR action audit logs for calls to the enable token and revoke token actions and correlate them with the invoking user role.
Baseline normal RSA SecurID action usage per user and alert on deviations, particularly on interactive rather than playbook-driven invocations.
Inspect installed app versions and flag any RSA SecurID Authentication Manager app instance below 1.0.5.

Monitoring Recommendations

Forward Splunk SOAR audit and activity logs to a centralized analytics platform for long-term retention and correlation with identity events.
Monitor RSA Authentication Manager server logs for token enable and revoke events that align in time with Splunk SOAR action executions.
Track privilege changes on SOAR roles that grant action-run permissions to identify scope expansion that would broaden exposure.

How to Mitigate CVE-2026-76383

Immediate Actions Required

Upgrade the RSA SecurID Authentication Manager app for Splunk SOAR to version 1.0.5 or later on all SOAR instances.
Audit which users and roles currently hold permission to run the enable token and revoke token actions and remove unnecessary grants.
Review historical action results and purge stored outputs that contain cleartext token_serial values where retention policy allows.

Patch Information

Splunk has addressed the issue in version 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR. The fix marks the affected token_serial action parameter as a password type so that Splunk SOAR masks the value in the interface, action results, and CLI output. Consult the Splunk Security Advisory SVD-2026-0806 for the authoritative patch guidance.

Workarounds

Restrict the SOAR roles authorized to execute the RSA SecurID enable token and revoke token actions to a small set of trusted administrators until the app is upgraded.
Route RSA SecurID token operations exclusively through vetted playbooks that suppress or redact action result rendering to end users.
Rotate or reissue RSA SecurID tokens whose serials may have been exposed to users without a legitimate need to know.

bash

# Configuration example: verify installed app version in Splunk SOAR
phenv python -c "import phantom_common; print(phantom_common.get_app_version('rsa_securid_authentication_manager'))"

# Upgrade the app package to the fixed release
phenv pip install --upgrade rsa_securid_authentication_manager==1.0.5