In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS… (CVE-2026-76376)

The AWS IAM app for Splunk SOAR versions prior to 2.1.9 contain an information disclosure vulnerability (CVE-2026-76376). A user holding a role with permission to execute actions can invoke an action that accepts AWS credentials as a parameter. Since this parameter is not masked or treated as a password field, the credentials are shown in cleartext in the user interface, potentially exposing sensitive AWS credentials. This vulnerability is categorized under CWE-312 (Cleartext Storage of Sensitive Information).

The vulnerability allows users with action execution permissions to view sensitive AWS credentials in cleartext within the Splunk SOAR interface. This could lead to unauthorized access if the credentials are exposed to unintended users. However, the vulnerability does not allow privilege escalation or denial of service. The CVSS score is 4.3 (medium severity), reflecting limited impact confined to information disclosure.

A fix is available in version 2.1.9 of the AWS IAM app for Splunk SOAR, which properly masks the credentials parameter to prevent cleartext exposure. Users should upgrade to version 2.1.9 or later to remediate this vulnerability. No other mitigations are indicated or necessary if the upgrade is applied.