Insecure User Authorization in Splunk Enterprise and Splunk Secure Gateway
CVE-2026-76292

6.5MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Splunk Secure Gateway
Vendor
CVE Published:
21 October 2026

What is CVE-2026-76292?

In versions of Splunk Enterprise prior to 10.4.4 and Splunk Secure Gateway versions below 3.10.12, a flaw exists that allows a low-privileged user to access mobile alert notification data of other users. This vulnerability arises from the lack of proper user-level authorization checks on read requests made to the App Key Value Store's REST API endpoints. Consequently, unauthorized users can exploit this gap to retrieve sensitive information, potentially leading to privacy breaches and unauthorized insights into user activities.

Affected Version(s)

Splunk Enterprise 10.4 < 10.4.4

Splunk Enterprise 10.2 < 10.2.8

Splunk Enterprise 10.0 < 10.0.11

References

https://advisory.splunk.com/advisories/SVD-2026-1007

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriel Nitu, Splunk
.