{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-76405","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","state":"PUBLISHED","assignerShortName":"cisco","dateReserved":"2026-08-19T12:02:03.632Z","datePublished":"2026-08-19T21:35:18.074Z","dateUpdated":"2026-08-20T15:26:30.983Z"},"containers":{"cna":{"affected":[{"product":"Splunk On-Call (VictorOps)","vendor":"Splunk","versions":[{"version":"1.0","status":"affected","versionType":"custom","lessThan":"1.0.43"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/markdown","value":"In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the \"admin\" or \"power\" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store). The exposure is possible because the Splunk On-Call (VictorOps) app does not fully mask the API key before storing it in a KV Store collection that the user can read. For more information see [About the app key value store](https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/administer-the-app-key-value-store/about-the-app-key-value-store) in the Splunk documentation."}],"value":"In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the \"admin\" or \"power\" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store). The exposure is possible because the Splunk On-Call (VictorOps) app does not fully mask the API key before storing it in a KV Store collection that the user can read. For more information see About the app key value store (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/administer-the-app-key-value-store/about-the-app-key-value-store) in the Splunk documentation."}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-0808"}],"title":"Information Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app","datePublic":"2026-08-19T00:00:00.000Z","metrics":[{"cvssV3_1":{"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"cwe","cweId":"CWE-312","description":"The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere."}]}],"source":{"advisory":"SVD-2026-0808"},"providerMetadata":{"orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco","dateUpdated":"2026-08-19T21:35:18.074Z"},"solutions":[{"lang":"en","value":"Upgrade each affected Splunk app or add-on to the applicable fixed version listed in Product Status."}],"workarounds":[{"lang":"en","value":"Turn off or remove the Splunk On-Call (VictorOps) app. For more information see [Manage app and add-on objects](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/meet-splunk-apps/manage-app-and-add-on-objects) in the Splunk documentation."}],"credits":[{"lang":"en","value":"Gabriel Nitu, Splunk","type":"reporter"}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-76405","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-20T15:09:23.278662Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-20T15:26:30.983Z"}}]}}