Unauthorized Access to Private Keys in Splunk Enterprise and Secure Gateway
CVE-2026-76261

5.3MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Splunk Secure Gateway
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76261?

In certain versions of Splunk Enterprise and Splunk Secure Gateway, unauthorized users may gain access to sensitive Spacebridge asymmetric private keys via the REST API. This vulnerability arises due to incomplete migration of private-key material in upgraded instances, leaving it accessible through an insecure default access control list. The issue primarily affects users lacking 'admin' or 'power' roles, potentially exposing critical private-key material stored within the app collection. It is vital for organizations using vulnerable versions to implement necessary updates and security practices to mitigate the risk of exposure.

Affected Version(s)

Splunk Enterprise 10.4 < 10.4.2

Splunk Enterprise 10.2 < 10.2.6

Splunk Enterprise 10.0 < 10.0.9

References

https://advisory.splunk.com/advisories/SVD-2026-0801

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriel Nitu, Splunk
.