CVE-2026-76376: The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. in Splunk AWS IAM app for Splunk SOAR

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, the credentials parameter in certain actions is not masked, causing sensitive AWS credentials to be displayed in cleartext in the user interface. This allows users with action execution permissions to expose these credentials. The root cause is the failure to mark the parameter as a password type, leading to information disclosure. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with network attack vector, low attack complexity, and requires privileges with permission to run actions.

Sensitive AWS credentials can be exposed in cleartext to users who have permission to run actions within the app. This could lead to unauthorized access if those credentials are misused. However, the impact is limited to confidentiality (information disclosure) without integrity or availability effects.

A patch is available for this vulnerability. Users should upgrade the AWS IAM app for Splunk SOAR to version 2.1.9 or later to ensure the credentials parameter is properly masked. No additional mitigation is required once the patch is applied.