CVE-2026-76405

Received Received - Intake

Splunk On-Call API Key Exposure via KV Store

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store). The exposure is possible because the Splunk On-Call (VictorOps) app does not fully mask the API key before storing it in a KV Store collection that the user can read. For more information see About the app key value store (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/administer-the-app-key-value-store/about-the-app-key-value-store) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76405

EUVD

EUVD-2026-62970

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	on-call	to 1.0.43 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase. A user without admin or power Splunk roles could read a partially masked API key stored in the App Key Value Store (KV Store). The app fails to fully mask the API key before storing it, allowing unauthorized access to sensitive information.

Detection Guidance

Check Splunk On-Call (VictorOps) app version on Splunkbase. If it is below 1.0.43, the vulnerability may be present. Inspect KV Store collections for partially masked API keys that should be fully masked.

Impact Analysis

If you use the affected Splunk On-Call app, an attacker with limited privileges could access a partially exposed API key. This could lead to unauthorized use of the API, potential data breaches, or integration compromises depending on the API's permissions.

Mitigation Strategies

Upgrade the Splunk On-Call (VictorOps) app to version 1.0.43 or later on Splunkbase. Review and rotate any exposed API keys stored in the KV Store.

Hi! I’m here to help you understand CVE-2026-76405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70