CVE-2026-76256

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user without the admin or power roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is due to multiple REST API endpoints not enforcing authorization requirements before processing requests.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to the Splunk Enterprise REST API using a system-level session token and modify the Splunk platform configuration. The user could then obtain a session token without a password and use it to access all relevant data and affect system integrity. The vulnerability exists because Splunk Secure Gateway does not validate decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.9, 3.9.23, and 3.8.70, a user without 'admin' or 'power' roles can read Spacebridge private keys via the Key Value Store REST API. The vulnerability occurs on instances upgraded from older versions when private-key migration is incomplete, leaving keys in a collection with an insecure default ACL.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.10, 3.9.24, and 3.8.71, a user without 'admin' or 'power' roles can register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile user requests, including tokens, to an attacker-controlled URL. The vulnerability is due to a hard-coded cryptographic key in the companion app registration handler allowing unrestricted callback URL registration.

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.10, 3.9.24, and 3.8.71, a user with permissions to list storage passwords but without Splunk Secure Gateway admin privileges can access MDM signing secrets, compromising mobile-device enrollment trust. The vulnerability is due to REST API endpoints for deployment bundle, SAML setup, and companion app workflows not requiring Splunk Secure Gateway admin privileges.