CVE-2026-76262

Received Received - Intake

Information Disclosure in Splunk Enterprise Edge Processor

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterprise versions below 10.4. The information disclosure is possible because the Prometheus metrics endpoint in the Edge Processor SPL2 Preview sidecar lacks authentication, which lets any client that can reach the sidecar retrieve the metrics without credentials. For more information see About Splunk sidecars (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/about-splunk-sidecars) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76262

EUVD

EUVD-2026-63114

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 10.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise 10.4 versions below 10.4.2. An unauthenticated user can read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, exposing runtime and build metadata. The issue occurs because the Prometheus metrics endpoint lacks authentication, allowing any client with network access to retrieve sensitive metrics without credentials.

Detection Guidance

To detect this vulnerability, check if Splunk Enterprise 10.4 versions below 10.4.2 are running and if the Edge Processor SPL2 Preview sidecar is exposed without authentication. Inspect network traffic for unauthenticated access to Prometheus metrics endpoints on the sidecar. Use commands like curl to query the metrics endpoint (e.g., curl http://<sidecar-ip>:<port>/metrics) to verify if sensitive data is exposed.

Impact Analysis

An attacker could exploit this to gather sensitive information about the Splunk sidecar's runtime and build details. This data might help in further attacks by revealing system configurations or weaknesses. However, it does not allow modification of data or system compromise directly.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive system metadata, potentially violating data protection requirements under GDPR or HIPAA if such information is considered protected. Organizations must ensure metrics endpoints are secured to maintain compliance.

Mitigation Strategies

Upgrade Splunk Enterprise to version 10.4.2 or later to address the vulnerability. Ensure the Edge Processor SPL2 Preview sidecar is not exposed to untrusted networks. If exposure is necessary, implement network-level authentication or access controls to restrict access to the Prometheus metrics endpoint.

Hi! I’m here to help you understand CVE-2026-76262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70