Vulnerability · Published Oct 7, 2026 · Assigned by cisco
CVE-2026-76272Missing Access Control through the REST API in Splunk Secure Gateway
Medium 4.3
In plain English
A medium-severity missing authorization in Splunk Enterprise from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user is authorized to request a signature. Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are also affected. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.4 – before 10.4.310.2 – before 10.2.710.0 – before 10.0.109.4 – before 9.4.15 |
| Splunk | Splunk Secure Gateway | 3.10 – before 3.10.113.9 – before 3.9.253.8 – before 3.8.72 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N