CVE-2026-76340

Received Received - Intake

Unauthenticated Token Key Reload in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer (REST) API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because the REST API does not require authentication or the change_authentication capability for the token-key reload action. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76340

EUVD

EUVD-2026-62905

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	to 10.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Splunk Enterprise 10.4 versions below 10.4.2 allows an unauthenticated user to reload token-signing keys via the REST API. The issue occurs because the API does not require authentication or the change_authentication capability for this action.

Detection Guidance

Detecting this vulnerability requires checking Splunk Enterprise versions below 10.4.2 and verifying if unauthenticated REST API calls can reload token-signing keys. Review Splunk logs for unusual API activity or unauthorized key reloads. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to reload token-signing keys, potentially disrupting authentication mechanisms or causing service instability. However, it does not directly expose sensitive data or allow unauthorized access.

Mitigation Strategies

Upgrade Splunk Enterprise to version 10.4.2 or later to address the vulnerability. Ensure the REST API requires authentication and the change_authentication capability for token-key reload actions. Review and restrict user roles with unnecessary capabilities.

Hi! I’m here to help you understand CVE-2026-76340. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70