CVE-2026-76292 in Splunk
Summary
by MITRE • 10/22/2026
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints. The vulnerability is possible because the affected Splunk Secure Gateway App Key Value Store collections do not enforce user-level authorization for read requests. For more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-the-app-key-value-store/about-the-app-key-value-store) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
A critical authorization flaw exists within specific versions of Splunk Enterprise and Splunk Secure Gateway, allowing low-privileged users to access sensitive data belonging to other users. This vulnerability affects Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16, as well as Splunk Secure Gateway versions before 3.10.12, 3.9.26, and 3.8.73. The core issue stems from a failure in the access control mechanisms governing the App Key Value Store KV Store REST API endpoints used by Splunk Secure Gateway. Specifically, these collections do not enforce user-level authorization for read requests, creating an insecure direct object reference scenario where data intended to be isolated per user is accessible across different accounts without proper validation of permissions.
The technical mechanism behind this vulnerability involves the interaction between low-privileged users and the REST API endpoints associated with the Splunk Secure Gateway App Key Value Store. In a properly secured environment, any request to read or modify stored key-value pairs should trigger an authorization check that verifies whether the requesting user holds sufficient privileges, such as the admin role in Splunk Enterprise or the sc_admin role in Splunk Secure Gateway. However, due to this implementation flaw, these checks are bypassed for read operations on specific collections. Consequently, a low-privileged user who lacks administrative rights can construct API requests that retrieve mobile alert notification data associated with other users within the same instance. This represents a significant breach of confidentiality as it allows unauthorized entities to view private communication metadata and alerts intended exclusively for their respective account holders.
The operational impact of this vulnerability is substantial, particularly in multi-tenant environments or organizations where sensitive information is disseminated via mobile alert notifications. Attackers with low-level access can exploit this flaw to gather intelligence on other users activities, potentially identifying security incidents, system configurations, or business-critical alerts before authorized personnel are aware of them. This capability facilitates further attacks by providing attackers with contextual information that could be used for social engineering, targeted phishing, or planning more sophisticated intrusions against higher-privileged accounts. The exposure of mobile alert data also violates privacy expectations and may lead to compliance violations depending on the regulatory framework governing the organization's data handling practices.
This vulnerability aligns closely with CWE Category 284 Improper Access Control, specifically reflecting characteristics of Insecure Direct Object References where object identifiers are exposed without adequate authorization checks. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as it allows an attacker to leverage existing low-privileged credentials to access data outside their intended scope, effectively escalating the utility of compromised or default accounts through information disclosure rather than privilege escalation in the traditional sense. The flaw highlights a common pitfall in web application development where API endpoints are configured with broad read permissions without implementing granular row-level security policies for shared storage mechanisms like KV Stores.
To mitigate this risk, organizations running affected versions must upgrade Splunk Enterprise to version 10.4.4 or later, including the maintenance releases 10.2.8, 10.0.11, and 9.4.16. Similarly, users of Splunk Secure Gateway should update to version 3.10.12 or newer, encompassing versions 3.9.26 and 3.8.73. These updates contain the necessary patches that enforce proper user-level authorization checks on the App Key Value Store REST API endpoints. Until upgrades are performed, administrators can implement network-level controls to restrict access to these specific API endpoints from untrusted networks or low-privileged IP ranges. Additionally, reviewing and tightening role-based permissions within Splunk Enterprise ensures that even if such vulnerabilities exist in future updates, the blast radius of any potential exploitation is minimized by adhering to the principle of least privilege for all user roles interacting with sensitive data stores.