Description

In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's token_serial parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:24.467Z",
  "pubdate": "2026-08-19T22:17:24.467Z",
  "executiveSummary": "An information disclosure vulnerability exists in versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR.\nThe vulnerability arises due to the failure to properly mask the token_serial parameter as a password within the enable token and revoke token actions.\nAs a result, sensitive token serials are exposed in cleartext within the user interface during action execution.\nAn attacker or authorized user with permissions to execute actions can view these sensitive tokens, leading to unauthorized exposure of cryptographic or authentication-related data.\nExploitation requires a user to hold a role with permissions to run actions within the Splunk SOAR platform.\nThe risk implication involves the compromise of sensitive token identifiers, which could facilitate downstream security degradation or unauthorized tracking of authentication tokens.",
  "technicalDetails": "The root cause of the vulnerability is the incorrect configuration of action input parameters within the RSA SecurID Authentication Manager app for Splunk SOAR.\nSpecifically, the app fails to designate the token_serial parameter utilized in the enable token and revoke token actions as a password or masked input type.\nBecause the parameter lacks the appropriate masking attribute, the Splunk SOAR user interface renders the input value in cleartext during and after action invocation.\nThe vulnerable components are the enable token and revoke token actions defined within the application package for versions below 1.0.5.\nAuthentication and privilege requirements dictate that the executing user must hold a specific role granting permissions to run actions within the Splunk SOAR environment.\nThe attack flow proceeds as follows: 1) An authenticated user with action execution privileges navigates to the Splunk SOAR user interface. 2) The user invokes either the enable token or revoke token action against the RSA SecurID Authentication Manager integration. 3) The user supplies the required token_serial parameter during the execution setup. 4) Due to the lack of parameter masking, the platform records and displays the token_serial in cleartext within the UI logs, audit trails, or execution views. 5) Any observer with access to the user interface or execution history can harvest the exposed token serial in plaintext.\nPost-exploitation impact includes the unauthorized disclosure of sensitive token identifiers, potentially aiding in reconnaissance or targeted attacks against the underlying RSA SecurID infrastructure."
}