CVE-2026-76272: Missing Access Control through the REST API in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user is authorized to request a signature. Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are also affected. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.3 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.7 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.10 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.15 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.10.11 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.9.25 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.8.72
Event History
Frequently Asked Questions
Which users could exploit this issue?
A user who does not hold the Splunk "admin" or "power" role could exploit the issue. Exploitation requires that the user can make requests to the affected Splunk Secure Gateway REST API.
What could an attacker do if exploitation succeeds?
The attacker could cause Splunk Secure Gateway to sign payloads controlled by the attacker. The provided severity vector indicates integrity impact, with no stated confidentiality or availability impact.
Which releases need to be updated?
Affected Splunk Enterprise releases are those below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. Affected Splunk Secure Gateway releases are those below 3.10.11, 3.9.25, and 3.8.72.
What can be done before patches are installed?
Restrict access to the affected REST API to authorized users and review role capabilities so untrusted users cannot request signatures. The issue exists because Secure Gateway does not verify whether the requesting user is authorized to request a signature.