CVE-2026-76351: Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to the Splunk Enterprise Representational State Transfer (REST) API using a system-level session token and modify the Splunk platform configuration. The user could then obtain a session token without a password and use it to access all relevant data and affect system integrity. The vulnerability is possible because Splunk Secure Gateway does not validate decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.10.9 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.9.23 - Upgrade
Upgrade
Splunk Secure Gatewayto a version that resolves this vulnerability.Fixed in 3.8.70
Event History
Frequently Asked Questions
Which users can exploit this issue?
A Splunk user who does not hold the "admin" or "power" role can exploit the issue. Exploitation requires the ability to supply crafted report notification data.
What access could an attacker gain after exploitation?
The attacker could cause Splunk Secure Gateway to make REST API requests with a system-level session token, modify Splunk platform configuration, and obtain a session token without a password. That token could provide access to all relevant data and allow the attacker to affect system integrity.
Which versions need remediation?
Affected Splunk Enterprise versions are below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Affected Splunk Secure Gateway versions are below 3.10.9, 3.9.23, and 3.8.70.