Description

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-08-19T22:17:23.450Z",
  "pubdate": "2026-08-19T22:17:23.450Z",
  "executiveSummary": "An information disclosure vulnerability exists in versions below 2.3.8 of the AD LDAP app for Splunk SOAR. The vulnerability arises from insecure logging behavior during action execution, allowing sensitive credentials to be exposed in plaintext. The impact includes the unauthorized disclosure of sensitive authentication material stored within the process environment variables. The affected product is the AD LDAP app for Splunk SOAR in versions prior to 2.3.8. The risk implication centers on credential compromise, enabling potential lateral movement or unauthorized access to integrated directory services. Attacker capabilities require the ability to invoke connector actions. Exploitation requirements mandate that the user holds a role with explicit permissions to run actions within the Splunk SOAR platform, leading to the full connector process environment being written to a persistent debug log file.",
  "technicalDetails": "The vulnerability is rooted in improper handling of debug logging within the AD LDAP app for Splunk SOAR, affecting versions below 2.3.8. When a user invokes an action, the underlying connector process outputs its complete runtime environment to a persistent debug log file in plaintext format. The vulnerable component is the connector execution and logging mechanism of the AD LDAP app. Authentication requirements dictate that the user must be authenticated to the Splunk SOAR platform. Privilege requirements specify that the user must hold a role possessing explicit permissions to run actions. Network exposure is localized to the Splunk SOAR instance and access to the persistent debug logs. The exploitation method involves triggering a specific connector action that forces the application to dump the full process environment variables, which include sensitive credentials, directly into a plaintext debug log file. The step-by-step attack flow proceeds as follows: First, an authenticated user or an attacker leveraging a compromised account with action-execution privileges identifies or triggers an action provided by the AD LDAP app. Second, the execution of this action causes the application internals to capture and persist the entire process environment to disk for debugging purposes. Third, the resulting debug log file retains the sensitive credentials in unencrypted plaintext. Finally, any entity with read access to the persistent debug log files can harvest these credentials to conduct subsequent unauthorized authentication attempts against active directory services or related enterprise infrastructure."
}