CVE-2026-76385 Overview
CVE-2026-76385 is an information disclosure vulnerability in the Venafi app for Splunk SOAR versions below 2.1.4. The app fails to mark the keystore_password and password parameters of the get certificate action as password fields. A user assigned a role with permission to run actions can invoke the action and view keystore and private-key passwords in cleartext through the Splunk SOAR user interface. The weakness is classified under CWE-312: Cleartext Storage of Sensitive Information and requires low-privileged authenticated access to exploit.
Critical Impact
Authenticated SOAR users with action-execution permissions can harvest keystore and private-key passwords displayed in cleartext, enabling downstream compromise of certificate assets.
Affected Products
- Venafi app for Splunk SOAR versions prior to 2.1.4
- Splunk SOAR deployments integrating the vulnerable Venafi app
- Certificate assets managed through the get certificate action
Discovery Timeline
- 2026-08-19 - CVE-2026-76385 published to the National Vulnerability Database
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76385
Vulnerability Analysis
The Venafi app for Splunk SOAR exposes the get certificate action, which accepts keystore_password and password parameters. These parameters carry secrets protecting keystores and private keys managed by Venafi. Splunk SOAR relies on app metadata to determine whether an action parameter should be masked in the user interface. The affected app does not declare these parameters as password type, so SOAR renders their values as plaintext strings in the action results and run history.
Any authenticated user assigned a role with the run-actions capability can invoke the action and observe the disclosed secrets. The attack requires no user interaction beyond navigating the SOAR interface and does not affect data integrity or system availability.
Root Cause
The root cause is a metadata omission in the Venafi app manifest. Action parameter definitions did not set the type attribute to password, which is the mechanism Splunk SOAR uses to trigger masking, redaction in logs, and secure handling in the UI. Without that annotation, SOAR treats the values as generic strings and renders them in cleartext.
Attack Vector
Exploitation requires an authenticated Splunk SOAR account with a role permitting action execution. The attacker runs the get certificate action from the Investigation, Playbook, or Command Line Interface entry points documented in Splunk SOAR's action documentation. The resulting action record displays the supplied keystore_password and password values in cleartext, which the attacker can copy for later use against the associated keystore or private key.
No verified proof-of-concept code is published for this issue. Refer to the Splunk Security Advisory SVD-2026-0806 for vendor-authoritative technical details.
Detection Methods for CVE-2026-76385
Indicators of Compromise
- Action run history entries for the Venafi get certificate action showing populated keystore_password or password fields in cleartext.
- Unexpected invocations of the get certificate action by users outside of certificate operations teams.
- Playbook execution logs referencing the Venafi app action with parameter values captured in exported artifacts.
Detection Strategies
- Audit Splunk SOAR action history for all executions of the Venafi get certificate action prior to upgrading to version 2.1.4.
- Review SOAR role assignments to identify accounts that hold action-execution privileges but do not require them.
- Correlate SOAR audit events with certificate management activity in Venafi to detect anomalous retrieval patterns.
Monitoring Recommendations
- Enable and centralize Splunk SOAR audit logging, forwarding events to a SIEM for long-term retention and alerting.
- Alert on any invocation of the vulnerable action by non-administrative users until the app is patched.
- Monitor for exports of action results or playbook run data that could carry disclosed secrets outside the SOAR platform.
How to Mitigate CVE-2026-76385
Immediate Actions Required
- Upgrade the Venafi app for Splunk SOAR to version 2.1.4 or later on all SOAR instances.
- Rotate any keystore and private-key passwords that were passed to the get certificate action while the vulnerable app was installed.
- Restrict the SOAR role permission to run actions to a minimal set of trusted operators pending remediation.
Patch Information
Splunk addressed the disclosure in Venafi app for Splunk SOAR version 2.1.4 by marking the affected action parameters as password fields, enabling SOAR's built-in masking. Refer to the Splunk Security Advisory SVD-2026-0806 for the vendor-provided fix details and download instructions.
Workarounds
- Disable or remove the Venafi app for Splunk SOAR until the patched version is deployed.
- Avoid invoking the get certificate action with sensitive keystore_password or password values on vulnerable versions.
- Purge historical action results containing exposed secrets from the SOAR database and any downstream storage.
# Verify installed Venafi app version on Splunk SOAR (on-premises)
phenv python -c "import json,glob; [print(json.load(open(f)).get('name'), json.load(open(f)).get('app_version')) for f in glob.glob('/opt/phantom/apps/*venafi*/*.json')]"
# Rotate a keystore password after upgrading (example using keytool)
keytool -storepasswd -keystore /path/to/keystore.jks -storepass OLD_PASSWORD -new NEW_PASSWORD
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
