CVE-2026-76376

Received Received - Intake

AWS Credential Exposure in Splunk SOAR IAM App

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76376

EUVD

EUVD-2026-62941

Affected Vendors & Products

Vendor	Product	Version / Range
aws	iam_app	to 2.1.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability exists in AWS IAM app for Splunk SOAR versions below 2.1.9. A user with permission to run actions can expose sensitive AWS credentials by invoking an action that accepts a credentials parameter. The parameter is not masked in the UI, showing credentials in cleartext.

Detection Guidance

To detect this vulnerability, check if you are using AWS IAM app for Splunk SOAR version below 2.1.9. Review the app's configuration and actions to see if any parameters marked as credentials are exposed in cleartext in the UI. Inspect logs for any exposed AWS credentials.

Impact Analysis

An attacker with access to the UI could view exposed AWS credentials, potentially leading to unauthorized access to AWS resources. This could result in data breaches, resource misuse, or further compromise of connected systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (privacy and security) due to unauthorized exposure of sensitive data. Organizations may face penalties or legal consequences for failing to protect credentials.

Mitigation Strategies

Immediately upgrade the AWS IAM app for Splunk SOAR to version 2.1.9 or later. Review and update all actions to ensure sensitive parameters like credentials are properly masked. Rotate any exposed AWS credentials to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-76376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70