CVE-2026-76265: Improper Access Control through REST API Endpoints in Splunk Secure Gateway

Q: Which users can exploit this issue?

A Splunk user who does not have the admin or power role can exploit the affected REST API endpoints. The vulnerability requires authenticated access with a lower-privileged Splunk account; the provided data does not indicate that unauthenticated attackers can exploit it.

Q: What can an attacker do after exploiting the affected endpoints?

The attacker can access privileged Splunk Secure Gateway functionality and cause Splunk Secure Gateway to sign payloads controlled by the attacker. The supplied information identifies high confidentiality impact, with no stated integrity or availability impact.

Q: Which versions need remediation?

Affected Splunk Enterprise versions are below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. Affected Splunk Secure Gateway versions are below 3.10.11, 3.9.25, and 3.8.72.

Published Oct 7, 2026

Updated

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests.

Affected Software

9 affected components

Splunk Splunk Enterprise<10.4.3, <10.2.7, <10.0.10, <9.4.15

Splunk Splunk Secure Gateway<3.10.11, <3.9.25, <3.8.72

Splunk splunk>=9.4.0<9.4.15

Splunk splunk>=10.0.0<10.0.10

Splunk splunk>=10.2.0<10.2.7

Splunk splunk>=10.4.0<10.4.3

Splunk Splunk Secure Gateway>=3.8.0<3.8.72

Splunk Splunk Secure Gateway>=3.9.0<3.9.25

Splunk Splunk Secure Gateway>=3.10.0<3.10.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.4.3
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.2.7
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.0.10
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 9.4.15
Upgrade
Upgrade Splunk Secure Gateway to a version that resolves this vulnerability.
Fixed in 3.10.11
Upgrade
Upgrade Splunk Secure Gateway to a version that resolves this vulnerability.
Fixed in 3.9.25
Upgrade
Upgrade Splunk Secure Gateway to a version that resolves this vulnerability.
Fixed in 3.8.72

Event History

Oct 7, 2026

CVE Published

via MITRE·08:46 PM

Data Sourced

via MITRE·08:46 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which users can exploit this issue?

A Splunk user who does not have the admin or power role can exploit the affected REST API endpoints. The vulnerability requires authenticated access with a lower-privileged Splunk account; the provided data does not indicate that unauthenticated attackers can exploit it.

What can an attacker do after exploiting the affected endpoints?