Improper Access Control through REST API Endpoints in Splunk Secure Gateway
Summary
| CVE | CVE-2026-76265 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-07 21:17:17 UTC |
| Updated | 2026-10-09 17:16:48 UTC |
| Description | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.002340000 probability, percentile 0.131910000 (date 2026-10-09)
Problem Types: CWE-284 | CWE-284 The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Splunk | Splunk Enterprise | affected 10.4 10.4.3 custom | Not specified |
| CNA | Splunk | Splunk Enterprise | affected 10.2 10.2.7 custom | Not specified |
| CNA | Splunk | Splunk Enterprise | affected 10.0 10.0.10 custom | Not specified |
| CNA | Splunk | Splunk Enterprise | affected 9.4 9.4.15 custom | Not specified |
| CNA | Splunk | Splunk Secure Gateway | affected 3.10 3.10.11 custom | Not specified |
| CNA | Splunk | Splunk Secure Gateway | affected 3.9 3.9.25 custom | Not specified |
| CNA | Splunk | Splunk Secure Gateway | affected 3.8 3.8.72 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| advisory.splunk.com/advisories/SVD-2026-1001 | [email protected] | advisory.splunk.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Younes Zendour (m3l4n0ff) (en)
Additional Advisory Data
Solutions
CNA: Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15, or higher. Upgrade Splunk Secure Gateway to versions 3.10.11, 3.9.25, and 3.8.72, or higher.
Workarounds
CNA: Upgrade Splunk Secure Gateway to versions 3.10.11, 3.9.25, and 3.8.72, or higher. If you are not able to upgrade Splunk Enterprise or Splunk Secure Gateway, turn off or remove the Splunk Secure Gateway app. See [Manage app and add-on objects](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/meet-splunk-apps/manage-app-and-add-on-objects) in the Splunk documentation. Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.