Sensitive Information Exposure in Phantom App for Splunk SOAR

CVE-2026-76382

What is CVE-2026-76382?

In the Phantom app for Splunk SOAR, versions prior to 3.8.5, there is a vulnerability that leads to the exposure of a sensitive archive password when a user with permission to run actions invokes the deflate item action. This occurs because the password parameter used within the action is not masked, resulting in its display in cleartext on the user interface. The vulnerability arises from the neglect to classify the affected parameter as a password, enabling potential attackers to gain access to sensitive information.

References