CVE-2026-76380: The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. in Splunk CrowdStrike OAuth API app for Splunk SOAR

In CrowdStrike OAuth API app for Splunk SOAR versions 5.1 and 5.1.x before 5.1.3, a sensitive document password is exposed in cleartext in the UI when invoking the detonate file or detonate url actions. This happens because the document_password parameter is not treated as a password field and thus is not masked. Users with roles that permit running actions can view this password, leading to information disclosure. The vulnerability is identified as CVE-2026-76380 with a CVSS 3.1 base score of 4.3 (medium severity).

The vulnerability allows users with permission to run actions in the affected app versions to view sensitive document passwords in cleartext. This information disclosure could lead to unauthorized access to sensitive data if the password is reused or leveraged elsewhere. There is no indication of integrity or availability impact.

Upgrade to version 5.1.3 or later of the CrowdStrike OAuth API app for Splunk SOAR, where this issue is fixed by masking the document_password parameter. Until upgrading, restrict permissions to run actions only to trusted users to minimize exposure risk.