CVE-2026-76384 Overview
CVE-2026-76384 is an information disclosure vulnerability in the Splunk Attack Analyzer Connector for Splunk SOAR versions below 2.2.1. The connector fails to mask the archive_password parameter when a user invokes the detonate file or detonate url actions. As a result, the sensitive archive password is rendered in cleartext within the user interface. Any authenticated user holding a role with permission to run actions can view the exposed credential. The flaw stems from the application not marking the affected action parameter as a password field, classified under [CWE-312] Cleartext Storage of Sensitive Information.
Critical Impact
Authenticated SOAR users with action-execution permissions can view sensitive archive passwords in cleartext through the connector interface.
Affected Products
- Splunk Attack Analyzer Connector for Splunk SOAR versions below 2.2.1
- Splunk SOAR deployments integrating the vulnerable connector
- Splunk SOAR on-premises environments running the affected app
Discovery Timeline
- 2026-08-19 - CVE-2026-76384 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76384
Vulnerability Analysis
The Splunk Attack Analyzer Connector exposes two actions, detonate file and detonate url, that accept an archive_password parameter. This parameter is intended to allow analysts to submit password-protected archives for detonation and analysis. Because the connector metadata does not declare the parameter type as password, Splunk SOAR renders the value in cleartext in the action interface rather than masking it. Any user with a role granted permission to execute these actions can review action history and observe the password value. The disclosure is limited to confidentiality; the vulnerability does not permit modification or denial of service.
Root Cause
The root cause is an app manifest configuration error. Splunk SOAR relies on the connector's action definition to determine which parameters should be treated as secrets. When a parameter is marked as password, the platform masks input, redacts it from the UI, and handles storage appropriately. The affected connector versions omit this classification for archive_password, causing SOAR to treat it as an ordinary string. The condition maps to [CWE-312] Cleartext Storage of Sensitive Information.
Attack Vector
Exploitation requires an authenticated SOAR user with a role authorized to run the detonate file or detonate url action. The attacker does not need administrative privileges. After the action executes, the archive password is visible in the action results and history within the SOAR user interface. Refer to the Splunk Security Advisory SVD-2026-0806 for vendor details on the affected component and remediation.
Detection Methods for CVE-2026-76384
Indicators of Compromise
- Presence of Splunk Attack Analyzer Connector versions below 2.2.1 on any Splunk SOAR instance.
- Historical action records containing detonate file or detonate url invocations with populated archive_password values visible in cleartext.
- Audit log entries showing non-administrative roles accessing action results for Attack Analyzer detonation actions.
Detection Strategies
- Inventory installed SOAR apps and compare the Attack Analyzer Connector version against 2.2.1 as the fixed baseline.
- Query SOAR audit logs for calls to detonate_file and detonate_url actions and correlate against user roles that should not access archive credentials.
- Review saved playbooks and action runs for archive_password parameter usage to identify credentials that may have been exposed and require rotation.
Monitoring Recommendations
- Alert on installation or reinstallation of Splunk Attack Analyzer Connector versions prior to 2.2.1.
- Monitor SOAR role assignments for expansions that grant action-execution rights to users who do not require access to archive detonation workflows.
- Track ingestion of Splunk SOAR audit events into the security data lake and flag repeated views of Attack Analyzer action results by distinct users.
How to Mitigate CVE-2026-76384
Immediate Actions Required
- Upgrade the Splunk Attack Analyzer Connector for Splunk SOAR to version 2.2.1 or later.
- Rotate any archive passwords that were previously submitted through the detonate file or detonate url actions on vulnerable versions.
- Review role permissions in Splunk SOAR and restrict action-execution privileges to users who require them.
Patch Information
Splunk has released Splunk Attack Analyzer Connector version 2.2.1, which marks the archive_password parameter as a password type so that Splunk SOAR masks the value in the user interface. Full remediation guidance is available in the Splunk Security Advisory SVD-2026-0806.
Workarounds
- Avoid passing archive passwords through the detonate file and detonate url actions until the connector is upgraded.
- Limit the roles that can execute Attack Analyzer actions to a minimal set of trusted analysts.
- Purge historical action results that contain exposed archive_password values after rotating the affected credentials.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
