Executive brief
The Phantom app for Splunk SOAR is a security automation connector used to orchestrate workflows and run security actions. In affected versions, users with permission to run actions can view sensitive passwords in cleartext in the user interface because the deflate item action's password parameter is not marked as a secure password field. This could allow an attacker with action-running privileges to obtain archive passwords and compromise protected data.
Technical details
This is an information disclosure vulnerability (CWE-312) affecting the Phantom app for Splunk SOAR versions below 3.8.5. The root cause is that the deflate item action does not mark its password parameter as a password-type field, causing the parameter value to be displayed in cleartext in the SOAR user interface instead of being masked. An authenticated user holding a role with permission to run actions can invoke this action and view the sensitive archive password. The attack vector is local/network (internal to the SOAR platform) and requires authentication with action-execution privileges. The fix is to upgrade to version 3.8.5 or later, which properly marks the password parameter as a sensitive field.
Affected products
- Splunk Phantom app for SOAR below 3.8.5
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in version 3.8.5