CVE-2026-76295 in Splunk
Summary
by MITRE • 10/22/2026
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the "admin" or "power" Splunk roles could view dashboard and report listings beyond the requested filter scope while remaining within objects that the user can access. The vulnerability is possible because Splunk Secure Gateway does not neutralize special characters in values before it creates filters for dashboard and report requests. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability affects multiple versions of Splunk Enterprise and Splunk Secure Gateway, specifically impacting releases prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 for the enterprise platform, as well as gateway versions below 3.10.12, 3.9.26, and 3.8.73. This security flaw represents a significant deviation from expected role-based access control mechanisms within the Splunk ecosystem. The core issue stems from an insufficient input validation process where special characters are not neutralized before being processed to create filters for dashboard and report requests. By failing to sanitize these inputs, the system allows maliciously crafted parameters to alter the logical structure of search queries or filter definitions in unintended ways.
From a technical perspective, this flaw enables users who lack administrative privileges or elevated power roles to bypass intended access restrictions. Normally, Splunk enforces strict boundaries based on user roles, ensuring that individuals can only interact with data and objects explicitly permitted by their assigned permissions. However, due to the failure to escape special characters in filter values, an attacker can manipulate these filters to expand the scope of visible content beyond what was originally requested or authorized. This manipulation allows low-privileged users to view dashboard listings and report details that should remain hidden from them, effectively circumventing the role-based access control layer designed to protect sensitive information within the platform.
The operational impact of this vulnerability is primarily centered on unauthorized data exposure and potential privilege escalation through information disclosure. While it does not directly allow for code execution or system compromise, it undermines the confidentiality guarantees provided by Splunk's security model. Attackers with limited access can potentially enumerate internal structures, discover sensitive reports, or identify configurations that were intended to be restricted. This level of visibility can aid in further reconnaissance activities within a compromised environment, allowing adversaries to map out high-value targets and plan more sophisticated attacks against the organization’s data infrastructure.
This vulnerability aligns closely with CWE-798, which describes the use of hard-coded credentials or improper access control due to insufficient input validation, as well as CWE-200, concerning exposure of sensitive information to an unauthorized actor. In terms of attack vectors and tactics, this behavior is consistent with ATT&CK technique T1530, Data from Cloud Storage Object Discovery, where adversaries explore cloud-based resources to find valuable data. It also relates to T1078, Valid Accounts, as the exploitation relies on using legitimate but low-privileged credentials to achieve unauthorized access. The failure to properly encode or escape special characters in filter parameters is a classic example of how improper neutralization of user input can lead to security bypasses.
To mitigate this risk, organizations running affected versions must immediately upgrade Splunk Enterprise and Splunk Secure Gateway to the specified patched releases. For enterprise users, this means updating to version 10.4.4 or later, 10.2.8 or later, 10.0.11 or later, or 9.4.16 or later. Similarly, administrators of Splunk Secure Gateway must ensure their installations are updated to at least version 3.10.12, 3.9.26, or 3.8.73 depending on the current branch. Until patches are applied, organizations should review and restrict user roles carefully, ensuring that no unnecessary permissions are granted to low-privileged accounts. Additionally, implementing web application firewalls with rules capable of detecting anomalous filter parameter patterns may provide a temporary layer of defense against exploitation attempts while patching efforts are underway.