CVE-2026-76380

Received Received - Intake

Information Disclosure in CrowdStrike OAuth API for Splunk SOAR

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive document password by invoking either the detonate file or detonate url action, because the action's document_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76380

EUVD

EUVD-2026-62945

Affected Vendors & Products

Vendor	Product	Version / Range
crowdstrike	oauth_api_app	to 5.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability exists in CrowdStrike OAuth API app for Splunk SOAR versions below 5.1.3. A user with permission to run actions can expose a sensitive document password by using the detonate file or detonate url action. The password is shown in cleartext in the UI because the app does not mask the document_password parameter.

Detection Guidance

This vulnerability can be detected by checking the version of the CrowdStrike OAuth API app for Splunk SOAR. If the version is below 5.1.3, the system is vulnerable. Review the app's configuration to ensure the detonate file or detonate url actions do not expose document passwords in the UI.

Impact Analysis

An attacker with access to the UI could view sensitive document passwords, leading to unauthorized access to protected documents. This could result in data breaches or further exploitation of exposed information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Exposure of passwords may violate these regulations.

Mitigation Strategies

Immediately upgrade the CrowdStrike OAuth API app for Splunk SOAR to version 5.1.3 or higher to address the information disclosure issue. Ensure that any sensitive document passwords are not exposed in the user interface by verifying the app's configuration.

Hi! I’m here to help you understand CVE-2026-76380. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70