CVE-2026-76295: SPL Injection through the REST API in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the "admin" or "power" Splunk roles could view dashboard and report listings beyond the requested filter scope while remaining within objects that the user can access. The vulnerability is possible because Splunk Secure Gateway does not neutralize special characters in values before it creates filters for dashboard and report requests. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.4 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.8 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.11 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.16 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.10.12 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.9.26 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.8.73
Event History
Frequently Asked Questions
Which users are realistically able to exploit this issue?
A user who does not have the Splunk "admin" or "power" role can exploit the issue, provided they can make dashboard or report requests through Splunk Secure Gateway. The exposure is limited to dashboard and report objects the user is already permitted to access.
What information could be exposed through exploitation?
An attacker may view dashboard and report listings beyond the scope of the requested filter. The provided information indicates low confidentiality impact and does not indicate modification or availability impact.
Are deployments affected by default?
The issue affects vulnerable Splunk Enterprise and Splunk Secure Gateway versions when Secure Gateway creates filters for dashboard or report requests using values containing special characters. The data does not state whether this request path is enabled or exposed in every default deployment.
What versions contain fixes?
Fixed Splunk Enterprise versions are 10.4.4, 10.2.8, 10.0.11, and 9.4.16. Fixed Splunk Secure Gateway versions are 3.10.12, 3.9.26, and 3.8.73.