CVE-2026-76257: Missing Authorization through REST API Endpoints in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobile Device Management signing secrets that compromise all affected mobile-device enrollment trust through Splunk Secure Gateway. The vulnerability is possible because Splunk Secure Gateway Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Splunk Secure Gateway administration privileges before processing requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.10.10 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.9.24 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.8.71
Event History
Frequently Asked Questions
Which users could exploit this issue?
A user needs a Splunk role that permits listing storage passwords. Splunk Secure Gateway administration privileges are not required.
What could an attacker obtain or affect?
An eligible user could access Mobile Device Management signing secrets. Exposure of those secrets can compromise enrollment trust for all affected mobile devices through Splunk Secure Gateway.
Which API functionality is affected?
The affected Splunk Secure Gateway REST API endpoints support deployment bundle, Security Assertion Markup Language setup, and companion app workflows. These endpoints process requests without first requiring Secure Gateway administration privileges.
Which releases contain fixes?
Fixed Splunk Enterprise releases are 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Fixed Splunk Secure Gateway releases are 3.10.10, 3.9.24, and 3.8.71.