Description

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temp_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:23.697Z",
  "pubdate": "2026-08-19T22:17:23.697Z",
  "executiveSummary": "An information disclosure vulnerability exists in versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR. The vulnerability arises from an unmasked temporary password parameter within the reset password action, exposing sensitive credentials in cleartext via the user interface. The impact allows authorized users possessing permissions to run actions to inadvertently view sensitive passwords during execution. Affected systems include Splunk SOAR deployments utilizing vulnerable versions of the Azure AD Graph app. The risk implications involve the potential exposure of privileged authentication materials to operators or viewers of the user interface. Attacker capabilities rely on legitimate access to the user interface where action execution results are rendered. Exploitation requirements mandate that the attacker or user holds a role with permissions to execute the reset password action and view the associated action outputs in the Splunk SOAR user interface.",
  "technicalDetails": "The root cause of the vulnerability is the failure of the Azure AD Graph app to properly designate the temp_password parameter as a sensitive password field within its configuration and action schema. Because the parameter lacks the necessary classification, the Splunk SOAR platform renders the returned temporary password value in cleartext within the user interface rather than applying standard masking mechanisms.\nThe vulnerable component is the reset password action implemented within the Azure AD Graph app for Splunk SOAR, specifically affecting all software versions below 2.5.3. Authentication and privilege requirements dictate that the user must already hold a designated role within Splunk SOAR that grants permissions to run actions and inspect their execution logs and parameters.\nThe step-by-step attack flow proceeds as follows: First, an authenticated user or an actor leveraging an authorized session navigates to the Splunk SOAR interface. Second, the actor invokes the reset password action targeting a specific user account via the Azure AD Graph app. Third, upon successful execution, the target application generates a temporary password and returns it within the action result payload. Fourth, because the app fails to mark the temp_password parameter as a password type, the Splunk SOAR user interface displays the generated temporary password in cleartext within the action results view.\nThe post-exploitation impact includes the unauthorized exposure of sensitive credential material to individuals who may have access to the UI or audit logs where cleartext parameters are persisted. This facilitates lateral movement, privilege escalation, or unauthorized access to Azure AD resources if the exposed temporary password is captured or improperly handled."
}