CVE-2026-76405: Information Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app
In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store). The exposure is possible because the Splunk On-Call (VictorOps) app does not fully mask the API key before storing it in a KV Store collection that the user can read. For more information see About the app key value store (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/administer-the-app-key-value-store/about-the-app-key-value-store) in the Splunk documentation.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Users who do not have the Splunk "admin" or "power" roles may be able to read the KV Store collection containing the partially masked API key. Exploitation requires a user account with access to that readable collection.
Which app versions are affected?
Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase are affected.
What information could an attacker obtain?
An affected user could read a partially masked Splunk On-Call API key from the App Key Value Store. The provided information does not state whether the exposed portion alone is sufficient to authenticate.