Read the docs
TI-2026-53428 Aliases CVE-2026-76373GHSA-5g3m-gvfm-wfx3

Filter Injection through Action Parameters in AD LDAP app for Splunk SOAR

Priority LOW 24CWE-90Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Fixed AD LDAP app for Splunk SOAR (Splunk): 2.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SplunkAD LDAP app for Splunk SOAR2.3 to before 2.3.82.3.8Patch availableCNA
  • AD LDAP app for Splunk SOAR VendorSplunk Affected 2.3 to before 2.3.8 Fixed in 2.3.8 Patch available CNA

Remediation

  • Fix · CNA AD LDAP app for Splunk SOAR (Splunk) Fixed in 2.3.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Splunk AD LDAP app for Splunk SOAR 2.3.8

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-53430 Information Disclosure through Environment Data Logging in AD LDAP app for Splunk SOARPriority LOW 23
    • TI-2026-53429 Information Disclosure through Sensitive Data Logging in AD LDAP app for Splunk SOARPriority LOW 20
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76373
  2. 2026-10-03 Alias added: GHSA-5g3m-gvfm-wfx3

References

Other 1

  • TI-2026-16444 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24841 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing CVSS 3.1HIGH 8.8
  • TI-2023-12257 Injection in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
  • TI-2022-13930 Information disclosure in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
  • TI-2022-13917 Incorrect default permissions in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
See all 450 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences