CVE-2026-76256: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. in Splunk Splunk Enterprise

In Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions prior to 3.10.9, 3.9.23, and 3.8.70, certain REST API endpoints related to Security Assertion Markup Language (SAML) setup and instance settings do not enforce proper authorization. This allows users without the 'admin' or 'power' roles to read sensitive configuration information. The vulnerability arises from missing authorization checks on these API endpoints, leading to unauthorized disclosure of sensitive data. The CVSS 3.1 base score is 4.3, indicating a medium severity impact focused on confidentiality. There is no indication of active exploitation or integrity/availability impact. The affected versions are explicitly listed, but no direct patch links or vendor advisory content is provided in the input.

Unauthorized users with roles lower than 'admin' or 'power' can access sensitive SAML setup and instance configuration information via REST API endpoints. This results in information disclosure but does not affect data integrity or system availability. The confidentiality impact is limited to configuration data exposure. No known active exploitation has been reported.

Patch status is not yet confirmed from the provided data. Users should consult the official Splunk vendor advisories to determine if patches or updates are available for the affected versions. Until patched, restrict access to Splunk REST API endpoints to authorized roles only and monitor for unauthorized access attempts. Do not rely on this summary alone for remediation decisions.