CVE-2026-76261 PUBLISHED

Insecure Default Access Control List through the REST API in Splunk Secure Gateway

Assigner: cisco
Reserved: 19.08.2026 Published: 19.08.2026 Updated: 19.08.2026

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected Spacebridge private-key material stored in the app collection, through the Splunk Secure Gateway App Key Value Store Representational State Transfer (REST) API. The vulnerability is possible on instances upgraded from older Splunk Secure Gateway deployments when the private-key migration remains incomplete, leaving key material in a collection with an insecure default access control list.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor Splunk
Product Splunk Enterprise
Versions
  • affected from 10.4 to 10.4.2 (excl.)
  • affected from 10.2 to 10.2.6 (excl.)
  • affected from 10.0 to 10.0.9 (excl.)
  • affected from 9.4 to 9.4.14 (excl.)
Vendor Splunk
Product Splunk Secure Gateway
Versions
  • affected from 3.10 to 3.10.9 (excl.)
  • affected from 3.9 to 3.9.23 (excl.)
  • affected from 3.8 to 3.8.70 (excl.)

Workarounds

Upgrade Splunk Secure Gateway to versions 3.10.9, 3.9.23, and 3.8.70, or higher. If you are not able to upgrade Splunk Enterprise or Splunk Secure Gateway, turn off or remove the Splunk Secure Gateway app. See Manage app and add-on objects in the Splunk documentation. Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

Solutions

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.

Credits

  • Gabriel Nitu, Splunk reporter

References

Problem Types

  • The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. cwe