CVE-2026-76258
MediumCVSS 6.5Summary
In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway below 3.10.10, 3.9.24, and 3.8.71, a user without 'admin' or 'power' roles can register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile user requests, including tokens, to an attacker-controlled URL. The vulnerability is due to a hard-coded cryptographic key in the companion app registration handler allowing unrestricted callback URL registration.
Risk Assessment
An attacker could intercept tokens and mobile user data, potentially leading to confidentiality and integrity breaches and unauthorized access to systems.
Recommendation
Upgrade Splunk Enterprise and Splunk Secure Gateway to patched versions. Restrict companion app registration to trusted users only.
Original NVD description (English source)
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile user requests, including tokens that compromise all relevant data available to the affected mobile user, to an attacker-controlled Uniform Resource Locator (URL). The vulnerability is possible because a hard-coded cryptographic key in the Splunk Secure Gateway companion app registration handler allows for arbitrary callback URL registration without restriction. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.