Vulnerability · Published Aug 19, 2026 · Assigned by cisco
CVE-2026-76340Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise
Medium 5.3
In plain English
A medium-severity missing authorization in Splunk Enterprise from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer (REST) API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because the REST API does not require authentication or the change_authentication capability for the token-key reload action. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.4 – before 10.4.2 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N