Information Disclosure in Splunk Enterprise by Splunk
CVE-2026-76274

6.5MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Vendor
CVE Published:
7 October 2026

What is CVE-2026-76274?

In specific versions of Splunk Enterprise, a user with the read_o11y_content role can exploit a weakness in the Splunk App for Splunk Observability Cloud that fails to properly validate outbound request destinations. This flaw allows redirection to an attacker-controlled host, potentially exposing sensitive Observability Cloud API tokens. It is crucial for Splunk users to be aware of this issue and ensure their systems are updated beyond the vulnerable versions to mitigate any risks associated with unauthorized access to sensitive API information.

Affected Version(s)

Splunk Enterprise 10.4 < 10.4.3

Splunk Enterprise 10.2 < 10.2.7

Splunk Enterprise 10.0 < 10.0.10

References

https://advisory.splunk.com/advisories/SVD-2026-1001

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriel Nitu, Splunk
.