CVE-2026-76261

Received Received - Intake

Sensitive Data Exposure in Splunk Enterprise via REST API

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected Spacebridge private-key material stored in the app collection, through the Splunk Secure Gateway App Key Value Store Representational State Transfer (REST) API. The vulnerability is possible on instances upgraded from older Splunk Secure Gateway deployments when the private-key migration remains incomplete, leaving key material in a collection with an insecure default access control list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76261

EUVD

EUVD-2026-63113

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 10.4.2 (exc)
splunk	splunk_enterprise	to 10.2.6 (exc)
splunk	splunk_enterprise	to 10.0.9 (exc)
splunk	splunk_enterprise	to 9.4.14 (exc)
splunk	splunk_secure_gateway	to 3.10.9 (exc)
splunk	splunk_secure_gateway	to 3.9.23 (exc)
splunk	splunk_secure_gateway	to 3.8.70 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise and Splunk Secure Gateway. A non-admin or non-power user can read Spacebridge asymmetric private keys through the Splunk Secure Gateway App Key Value Store REST API. This occurs in upgraded instances where private-key migration is incomplete, leaving keys in a collection with weak access controls.

Impact Analysis

An attacker could exploit this to access sensitive private keys, potentially compromising encrypted communications or stored data in Splunk Secure Gateway. This may lead to unauthorized access, data breaches, or further exploitation of Splunk environments.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data, such as personally identifiable information (PII) or protected health information (PHI). Organizations may face penalties for failing to protect such data under regulations like GDPR or HIPAA.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14, and Splunk Secure Gateway to versions 3.10.9, 3.9.23, or 3.8.70 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76261. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70