CVE-2026-76256: Information Exposure through REST API Endpoints in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information through Splunk Secure Gateway Representational State Transfer (REST) API endpoints. The vulnerability is possible because the affected Security Assertion Markup Language setup and instance settings REST API endpoints do not enforce authorization requirements before returning configuration information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.10.9 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.9.23 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.8.70
Event History
Frequently Asked Questions
Who can access the exposed configuration information?
Any authenticated Splunk user who does not have the admin or power role may be able to read the affected SAML setup and instance settings through Splunk Secure Gateway REST API endpoints. The attack vector is network-based and requires low privileges, but no user interaction.
Which deployments need remediation?
Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected, as are Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70. Deployments using the affected SAML setup and instance settings REST endpoints should prioritize upgrading to the applicable fixed version.
What information is at risk?
The exposed data consists of sensitive SAML setup and instance settings configuration information. The issue does not indicate modification or service-disruption capability; the listed impact is limited to confidentiality.