In Splunk SOAR versions below 8.7.0, an unauthenticated user who has previously accessed encrypted credential data can send that data as Basic authentication to the REST API. Because the system decrypts Basic authentication values before verifying credentials, the attacker triggers decryption and reveals the encrypted credentials, resulting in disclosure of sensitive information. This flaw is a classic example of improper handling of authentication data, categorized under CWE‑203.

The affected product is Splunk SOAR from Splunk, with vulnerable releases including all versions below 8.7.0. No specific patch versions are listed beyond the fix in 8.7.0.

The CVSS score of 5.9 indicates a moderate risk, and the vulnerability is not listed in the CISA KEV catalog. Because the EPSS score is not available, no publicly reported exploitation data is present. To exploit the flaw, an attacker must already possess encrypted credential data from the target instance and access the REST API unauthenticated. The flaw could lead to disclosure of confidential credential data and should be prioritized for remediation.