CVE-2026-76384: The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. in Splunk Splunk Attack Analyzer Connector for Splunk SOAR

In Splunk Attack Analyzer Connector for Splunk SOAR versions before 2.2.1, the archive_password parameter used in the detonate file or detonate url actions is not masked. As a result, users with roles that permit running these actions can view the archive password in cleartext in the UI. This is due to the application not marking the parameter as a password type, leading to sensitive information disclosure.

The vulnerability allows disclosure of a sensitive archive password to users who have permission to run specific actions in the affected application. This could lead to unauthorized access to protected archives if the password is exposed. The CVSS score of 4.3 reflects a medium severity impact with low complexity and no user interaction required, but limited to users with some privileges.

Upgrade to version 2.2.1 or later of the Splunk Attack Analyzer Connector for Splunk SOAR, where this issue is fixed by properly masking the archive_password parameter. Until then, restrict permissions to run the affected actions to trusted users only. Patch status is confirmed fixed in 2.2.1.