In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user who holds a role with permission to run actions could expose a… (CVE-2026-76380)

The CrowdStrike OAuth API app for Splunk SOAR versions prior to 5.1.3 contain an information disclosure vulnerability (CVE-2026-76380). Users with roles that permit running actions can see the document_password parameter in cleartext when invoking the detonate file or detonate url actions. This occurs because the parameter is not marked as a password field, causing it to be exposed in the UI. The vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information).

The vulnerability allows users with action execution permissions to view sensitive document passwords in cleartext within the user interface. This exposure could lead to unauthorized access to protected resources if the password is reused or further exploited. There is no indication of integrity or availability impact. The CVSS v3.1 base score is 4.3 (medium severity), reflecting a network attack vector with low complexity and requiring privileges but no user interaction.

A fix is available in version 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR. Users should upgrade to version 5.1.3 or later to ensure the document_password parameter is properly masked. Until then, restrict roles with permission to run actions to trusted users only. Patch status is not explicitly confirmed in vendor advisories here; verify with the vendor for official remediation guidance.