CVE-2026-76380

Name of the Vulnerable Software and Affected Versions CrowdStrike OAuth API app for Splunk SOAR versions prior to 5.1.3

Description A user with permissions to run actions can expose a sensitive document password through the user interface. This occurs when invoking the detonate file or detonate url actions, as the document password parameter is not masked and is displayed in cleartext. The issue stems from the application failing to mark the affected parameter as a password.

Recommendations Update to version 5.1.3 or later. As a temporary mitigation, avoid using the document password parameter in the detonate file and detonate url actions.