Description

In versions below 3.8.5 of the Phantom app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking the deflate item action, because the action's password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:24.340Z",
  "pubdate": "2026-08-19T22:17:24.340Z",
  "executiveSummary": "An information disclosure vulnerability exists in the Phantom app for Splunk SOAR in versions below 3.8.5. The vulnerability allows a user with permissions to run actions to expose a sensitive archive password in cleartext within the user interface when invoking the deflate item action. This occurs because the application fails to designate the affected action parameter as a password type, resulting in improper parameter masking.\nThe impact of this security flaw involves the unauthorized exposure of sensitive authentication credentials or cryptographic archive passwords to users who can view the action execution details within the user interface. Risk implications include the potential compromise of encrypted archives or sensitive data streams protected by the leaked password.\nAttacker capabilities are limited to users who already hold a role with permissions to run actions within the affected Splunk SOAR environment. Exploitation requirements mandate that the authenticated user invokes the specific deflate item action, thereby triggering the unmasked rendering of the sensitive password parameter in plaintext within the platform's execution interface.",
  "technicalDetails": "The root cause of the vulnerability resides in the implementation of the deflate item action within the Phantom app for Splunk SOAR. Specifically, the configuration metadata defining the action parameters fails to mark the sensitive password parameter with the appropriate masking or password type attribute. As a result, the Splunk SOAR user interface treats the input field as standard plaintext rather than obfuscating or masking the entered value.\nThe vulnerable component is the parameter definition schema of the deflate item action within versions below 3.8.5 of the Phantom app for Splunk SOAR. The affected software natively processes and renders action execution parameters in the user interface during runtime execution workflows.\nAuthentication and privilege requirements dictate that the attacking or viewing entity must be an authenticated user holding a role with explicit permissions to run actions within the Splunk SOAR platform. Network exposure is localized to the internal web interface of the Splunk SOAR deployment.\nThe step-by-step attack flow proceeds as follows: First, an authenticated user or attacker with permissions to execute actions navigates to the action execution interface in Splunk SOAR. Second, the user selects the vulnerable deflate item action provided by the Phantom app. Third, the user inputs a sensitive archive password into the unmasked parameter field. Fourth, upon execution or review of the action parameters within the user interface, the application renders the password in cleartext. Finally, any observer with access to the user interface execution history or screen can view the plaintext password, leading to unintended information disclosure."
}