Description

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temp_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:24.203Z",
  "pubdate": "2026-08-19T22:17:24.203Z",
  "executiveSummary": "An information disclosure vulnerability exists in the MS Graph for Active Directory app for Splunk SOAR in versions below 1.5.2. The vulnerability arises due to the application failing to properly designate sensitive action parameters as passwords. Consequently, when an authorized user invokes the reset password action, the temporary password generated during execution is rendered in cleartext within the user interface via the temp_password parameter. The primary impact is the unauthorized exposure of sensitive authentication credentials to users with permissions to execute SOAR actions. The risk implication involves potential credential theft and subsequent unauthorized access to Active Directory accounts managed via the integration. Exploitation requires an authenticated user holding a role with permissions to execute SOAR actions, enabling them to view the unmasked credential directly within the application's user interface during normal operational workflows.",
  "technicalDetails": "The root cause of the vulnerability is an improper input type definition within the MS Graph for Active Directory app for Splunk SOAR. Specifically, the action parameter governing temporary passwords, designated as temp_password, is not explicitly marked or typed as a password field by the application's configuration schema. In enterprise security orchestration and automated response (SOAR) platforms, parameters designated for sensitive data such as keys, tokens, or passwords must utilize masking mechanisms to prevent cleartext rendering in logs, execution histories, and the user interface. Because the MS Graph for Active Directory app omits this classification for the temp_password parameter, the Splunk SOAR platform processes and displays the value as standard plaintext.\nThe attack flow and exploitation method proceed as follows: First, an authenticated actor holding a role with explicit permissions to run actions initiates the password reset action against a target user account using the MS Graph for Active Directory app. Upon successful execution of the action by the underlying API, the application generates a temporary password and returns the result to the Splunk SOAR user interface. Because the temp_password parameter lacks password masking properties, the user interface displays the generated cleartext password directly to the operator. Any user with visibility into the action execution results can thus observe the sensitive password in cleartext.\nThe vulnerable component is the MS Graph for Active Directory app for Splunk SOAR, specifically affecting all versions below 1.5.2. Authentication and privilege requirements mandate that the actor possesses a role granting permissions to run SOAR actions. The post-exploitation impact includes the potential harvesting of sensitive credentials by unauthorized or insufficiently privileged operators who have access to action execution outputs, thereby violating the principle of least privilege and increasing the attack surface of the managed Active Directory environment."
}