CVE-2026-76379: The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. in Splunk Cisco Webex app for Splunk SOAR
CVE-2026-76379 affects the Cisco Webex app for Splunk SOAR versions equal to 2.2. The vulnerability allows users with permission to run actions to see sensitive meeting passwords in cleartext when using the schedule meeting action. This occurs because the password parameter is not masked in the user interface, leading to potential information disclosure. The issue arises from the app not marking the password parameter as sensitive. The CVSS score is 4.3, indicating a medium severity level.
AI Analysis
Technical Summary
In Cisco Webex app for Splunk SOAR version 2.2, the schedule meeting action exposes the meeting password in cleartext within the user interface to users who have permission to run actions. This is due to the password parameter not being masked or marked as a password field, resulting in sensitive information being visible and potentially accessible to unauthorized users within the control sphere. The vulnerability does not affect confidentiality beyond the password exposure, and does not impact integrity or availability.
Potential Impact
The impact is limited to the disclosure of sensitive meeting passwords to users who can run actions in the app. There is no indication of privilege escalation, code execution, or denial of service. The confidentiality of meeting passwords is compromised, which could lead to unauthorized meeting access if exposed to untrusted users.
Mitigation Recommendations
No official fix or patch is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the permission to run actions to trusted users only to minimize exposure. Monitor vendor communications for updates regarding an official fix.
CVE-2026-76379: The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. in Splunk Cisco Webex app for Splunk SOAR
Description
CVE-2026-76379 affects the Cisco Webex app for Splunk SOAR versions equal to 2.2. The vulnerability allows users with permission to run actions to see sensitive meeting passwords in cleartext when using the schedule meeting action. This occurs because the password parameter is not masked in the user interface, leading to potential information disclosure. The issue arises from the app not marking the password parameter as sensitive. The CVSS score is 4.3, indicating a medium severity level.
CVSS v3.1
Score 4.3medium
Affected software
pkg:github/splunk/cisco-webex-app-for-splunk-soarRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Cisco Webex app for Splunk SOAR version 2.2, the schedule meeting action exposes the meeting password in cleartext within the user interface to users who have permission to run actions. This is due to the password parameter not being masked or marked as a password field, resulting in sensitive information being visible and potentially accessible to unauthorized users within the control sphere. The vulnerability does not affect confidentiality beyond the password exposure, and does not impact integrity or availability.
Potential Impact
The impact is limited to the disclosure of sensitive meeting passwords to users who can run actions in the app. There is no indication of privilege escalation, code execution, or denial of service. The confidentiality of meeting passwords is compromised, which could lead to unauthorized meeting access if exposed to untrusted users.
Mitigation Recommendations
No official fix or patch is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the permission to run actions to trusted users only to minimize exposure. Monitor vendor communications for updates regarding an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2026-08-19T12:02:03.630Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a86225eacd9273b49a70433
Added to database: 08/19/2026, 21:38:38 UTC
Last enriched: 08/19/2026, 22:08:31 UTC
Last updated: 08/19/2026, 22:32:09 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.