{"id":"CVE-2026-76405","state":"PUBLISHED","title":"Information Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app","description":"In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the \"admin\" or \"power\" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store). The exposure is possible because the Splunk On-Call (VictorOps) app does not fully mask the API key before storing it in a KV Store collection that the user can read. For more information see About the app key value store (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/administer-the-app-key-value-store/about-the-app-key-value-store) in the Splunk documentation.","publishedAt":"2026-08-19T21:35:18.074Z","updatedAt":"2026-08-20T15:26:30.983Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"cisco"},"assigner":"cisco","products":["Splunk Splunk On-Call (VictorOps)"],"affected":[{"vendor":"Splunk","product":"Splunk On-Call (VictorOps)","versions":[{"version":"1.0","status":"affected","lessThan":"1.0.43","versionType":"custom"}]}],"references":["https://advisory.splunk.com/advisories/SVD-2026-0808"],"weaknesses":["CWE-312"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/76xxx/CVE-2026-76405.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-76405","state":"PUBLISHED","datePublished":"2026-08-19T21:35:18.074Z","dateUpdated":"2026-08-20T15:26:30.983Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2026-08-19T12:02:03.632Z"},"containers":{"cna":{"title":"Information Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app","descriptions":[{"lang":"en","value":"In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the \"admin\" or \"power\" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store). The exposure is possible because the Splunk On-Call (VictorOps) app does not fully mask the API key before storing it in a KV Store collection that the user can read. For more information see About the app key value store (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/administer-the-app-key-value-store/about-the-app-key-value-store) in the Splunk documentation."}],"affected":[{"vendor":"Splunk","product":"Splunk On-Call (VictorOps)","versions":[{"version":"1.0","status":"affected","lessThan":"1.0.43","versionType":"custom"}]}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-0808"}],"metrics":[{"cvssV3_1":{"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-312","lang":"en","type":"cwe","description":"The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere."}]}],"providerMetadata":{"shortName":"cisco","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateUpdated":"2026-08-19T21:35:18.074Z"},"datePublic":"2026-08-19T00:00:00.000Z","source":{"advisory":"SVD-2026-0808"},"solutions":[{"lang":"en","value":"Upgrade each affected Splunk app or add-on to the applicable fixed version listed in Product Status."}],"workarounds":[{"lang":"en","value":"Turn off or remove the Splunk On-Call (VictorOps) app. For more information see [Manage app and add-on objects](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/meet-splunk-apps/manage-app-and-add-on-objects) in the Splunk documentation."}],"credits":[{"lang":"en","value":"Gabriel Nitu, Splunk","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76405","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-20T15:09:23.278662Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-20T15:26:30.983Z"}}]}}}