Description

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystore_password and password parameters are not masked and are shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameters as passwords. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:24.710Z",
  "pubdate": "2026-08-19T22:17:24.710Z",
  "executiveSummary": "An information disclosure vulnerability exists in versions below 2.1.4 of the Venafi app for Splunk SOAR. The vulnerability arises from improper parameter definition within the application's action definitions, specifically failing to designate sensitive input fields as password types. Consequently, sensitive authentication material, such as keystore passwords and private-key passwords, is rendered in cleartext within the user interface when executing the get certificate action. The risk implication is the unauthorized exposure of cryptographic secrets to users who hold roles with permissions to run SOAR actions. An attacker or authenticated user with standard action-execution privileges can harvest these plaintext secrets, potentially leading to unauthorized access to downstream cryptographic keystores and private keys managed by Venafi. Exploitation requires authenticated access to the Splunk SOAR platform and an assigned role capable of invoking SOAR actions. No complex payload delivery or network-level interception is required, as the disclosure occurs natively within the application's user interface rendering engine during standard parameter inspection and action execution workflows.",
  "technicalDetails": "The vulnerability is rooted in the misconfiguration of the Venafi app for Splunk SOAR action parameter schemas for versions below 2.1.4. Specifically, the action parameters keystore_password and password associated with the get certificate action lack the required metadata or property designations that instruct the Splunk SOAR platform to mask input fields configured for sensitive data. In the Splunk SOAR architecture, action parameters must be explicitly typed or masked to prevent the platform's user interface and logging mechanisms from displaying input values in plaintext. Because the developers omitted this masking attribute, the platform treats the sensitive inputs as standard string parameters. When an authorized user initiates the get certificate action via the user interface, the input values provided for keystore_password and password are transmitted and subsequently rendered in cleartext within the UI components, execution history, or debugging views. The affected component is the app's action parameter definition schema responsible for input rendering. The exploitation vector requires an actor to possess authentication credentials to Splunk SOAR and a role specifically granted permissions to execute actions. Upon invoking the get certificate action, the user interface exposes the unmasked secrets directly to the browser DOM and local application tracing interfaces. The post-exploitation impact includes the compromise of cryptographic material, as the exposed keystore and private-key passwords can be reused by malicious insiders or compromised accounts to decrypt sensitive certificates and private keys stored within the integrated Venafi infrastructure, thereby undermining the confidentiality and integrity of enterprise cryptographic assets."
}