CVE-2026-76405: The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. in Splunk Splunk On-Call (VictorOps)
Description
A vulnerability in Splunk On-Call (VictorOps) app versions before 1.0.43 allows users without admin or power roles to read a partially masked API key stored in the App Key Value Store. The API key is not fully masked before storage, exposing sensitive information to unauthorized users with read access to the KV Store.
CVSS v3.1
Score 4.3medium
Affected software
Splunk
Splunk On-Call (VictorOps)
pkg:maven/com.splunk/splunk-on-call-victoropsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Splunk On-Call (VictorOps) app versions >=1.0 and <1.0.43, a user lacking admin or power Splunk roles can access a partially masked API key from the App Key Value Store. This occurs because the app does not fully mask the API key before storing it in a KV Store collection that is readable by such users. The vulnerability results in partial exposure of sensitive API credentials.
Potential Impact
The vulnerability allows users with limited privileges (non-admin, non-power roles) to read a partially masked API key, potentially leading to unauthorized access to the API if the partial key can be leveraged. However, the impact is limited to confidentiality as integrity and availability are not affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict read access to the KV Store collections containing API keys to trusted roles only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2026-08-19T12:02:03.632Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a862261acd9273b49a704a7
Added to database: 08/19/2026, 21:38:41 UTC
Last enriched: 09/11/2026, 06:03:34 UTC
Last updated: 10/04/2026, 10:02:29 UTC
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.