What’s Vulnerable › Vulnerabilities
CVE-2026-76261: Insecure Default Access Control List through the REST API in Splunk Secure Gateway
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-19 · updated 2026-10-26
- Weakness: CWE-732
Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected Spacebridge private-key material stored in the app collection, through the Splunk Secure Gateway App Key Value Store Representational State Transfer (REST) API. The vulnerability is possible on instances upgraded from older Splunk Secure Gateway deployments when the private-key migration remains incomplete, leaving key material in a collection with an insecure default access control list.
Affected products
- Splunk Enterprise: from 9.4.0 before 9.4.14; from 10.0.0 before 10.0.9; from 10.2.0 before 10.2.6; from 10.4.0 before 10.4.2 — fixed in 9.4.14, 10.0.9, 10.2.6, 10.4.2
- Splunk Secure Gateway: from 3.8.0 before 3.8.70; from 3.9.0 before 3.9.23; from 3.10.0 before 3.10.9 — fixed in 3.8.70, 3.9.23, 3.10.9
How to fix
Upgrade to a fixed version: Splunk Enterprise 9.4.14, 10.0.9, 10.2.6, 10.4.2; Splunk Secure Gateway 3.8.70, 3.9.23, 3.10.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-76261 or the next vulnerability affects your stack