CVE-2026-76257 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobile Device Management signing secrets that compromise all affected mobile-device enrollment trust through Splunk Secure Gateway. The vulnerability is possible because Splunk Secure Gateway Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Splunk Secure Gateway administration privileges before processing requests.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
A critical authorization bypass vulnerability exists within the Splunk Secure Gateway component of the Splunk Enterprise ecosystem, affecting versions prior to 10.4.2, 10.2.6, and 10.0.9 for Splunk Enterprise, as well as versions below 3.10.10, 3.9.24, and 3.8.71 for Splunk Secure Gateway. This flaw stems from an improper implementation of access control mechanisms on specific Representational State Transfer application programming interface endpoints that handle deployment bundles, Security Assertion Markup Language configuration, and companion app workflows. The core technical deficiency lies in the fact that these API endpoints do not enforce the requirement for Splunk Secure Gateway administration privileges before processing incoming requests. Consequently, any authenticated user possessing a role with permissions to list storage passwords can interact with these sensitive endpoints without holding the necessary administrative rights typically required for such operations.
The operational impact of this vulnerability is severe due to its direct association with Mobile Device Management signing secrets. By exploiting this authorization bypass, an attacker or malicious insider who has been granted limited access privileges can retrieve critical cryptographic materials used in the mobile device enrollment process. These signing secrets are fundamental to establishing trust between mobile devices and the Splunk Secure Gateway infrastructure. Compromise of these secrets allows for the forgery of trusted identities, effectively undermining the integrity of the entire mobile-device enrollment framework. This means that an adversary could potentially impersonate legitimate devices or intercept communications intended for authorized endpoints, leading to a complete breakdown in authentication assurance for mobile clients connecting through the gateway.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Assignment, as it involves granting capabilities to users who lack the requisite administrative level. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1078, specifically Valid Accounts and potentially T1550, Use Alternate Authentication Credentials, since the attacker leverages valid but insufficiently restricted credentials to access sensitive resources. The ability to list storage passwords combined with unrestricted API access creates a privilege escalation path that allows low-privileged users to perform high-level administrative functions related to security infrastructure configuration.
To mitigate this risk, organizations must immediately upgrade Splunk Enterprise and Splunk Secure Gateway to the patched versions mentioned above, which enforce stricter role-based access controls on these specific REST endpoints. Until patching is complete, administrators should review user roles and permissions within the Splunk environment to ensure that no non-administrative users have been granted excessive privileges related to storage password listing or API interaction with deployment and security configuration modules. Additionally, implementing network-level restrictions such as firewalls or access control lists can limit exposure of these endpoints to only those IP addresses known for legitimate administrative traffic, thereby reducing the attack surface available to potential adversaries exploiting this authorization flaw.