CVE-2026-76375: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. in Splunk AD LDAP app for Splunk SOAR

In the AD LDAP app for Splunk SOAR versions >=2.3 and <2.3.8, invoking an action by a user with action-running permissions causes the full connector process environment, including sensitive credentials, to be written in plaintext to a persistent debug log file. This can expose sensitive user information and provide guidance to an attacker. The vulnerability is identified as CVE-2026-76375 and has a CVSS 3.1 base score of 5.0 (medium severity).

Sensitive credentials and environment information can be exposed in plaintext within persistent debug log files. This exposure could aid an attacker in gaining further access or understanding of the environment. However, the impact is limited to confidentiality (partial information disclosure) with no direct integrity or availability impact reported.

Upgrade the AD LDAP app for Splunk SOAR to version 2.3.8 or later, where this issue is resolved. Users should avoid running actions that trigger logging of the full connector process environment in affected versions. Since this is an on-premises app, remediation requires applying the official update from Splunk.