In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and… (CVE-2026-76385)
Description
In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user with permission to run actions can see keystore and private-key passwords in cleartext when invoking the get certificate action. This occurs because the app does not mask the keystore_password and password parameters in the user interface, leading to information disclosure.
CVSS v3.1
Score 4.3medium
Affected software
pkg:github/venafi/app-for-splunk-soarRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Venafi app for Splunk SOAR versions prior to 2.1.4 contain an information disclosure vulnerability (CVE-2026-76385) where action parameters keystore_password and password are not masked. Users with roles that allow running actions can view these sensitive parameters in cleartext via the get certificate action. This is due to the app not marking these parameters as passwords, resulting in exposure of keystore and private-key passwords in the UI.
Potential Impact
An attacker or user with permission to run actions can obtain sensitive keystore and private-key passwords in cleartext, potentially compromising cryptographic materials. The vulnerability does not affect integrity or availability and requires at least low privileges (permission to run actions).
Mitigation Recommendations
Upgrade to version 2.1.4 or later of the Venafi app for Splunk SOAR where this issue is fixed. Since the vulnerability is due to unmasked parameters, applying the official fix will prevent password exposure. No other mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6j45-h5g9-c753
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-76385"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a870a86acd9273b49b5a0f4
Added to database: 08/20/2026, 14:09:10 UTC
Last enriched: 08/20/2026, 14:43:35 UTC
Last updated: 10/05/2026, 06:48:18 UTC
Views: 26
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.