CVE-2026-76257: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise and Splunk Secure Gateway, certain REST API endpoints related to deployment bundles, SAML setup, and companion app workflows do not require Secure Gateway administration privileges before processing requests. This lack of authorization check enables a user with a Splunk role that can list storage passwords, but without Secure Gateway admin rights, to access Mobile Device Management signing secrets. These secrets could compromise the trust of all affected mobile-device enrollments through Splunk Secure Gateway. The vulnerability is present in Splunk Enterprise versions >=9.4 <9.4.14, >=10.0 <10.0.9, >=10.2 <10.2.6, >=10.4 <10.4.2 and Splunk Secure Gateway versions >=3.8 <3.8.71, >=3.9 <3.9.24, >=3.10 <3.10.10.

An attacker with a Splunk role that permits listing storage passwords but lacking Secure Gateway admin privileges can access sensitive Mobile Device Management signing secrets. This exposure can compromise the trust model for mobile-device enrollment managed via Splunk Secure Gateway, potentially allowing unauthorized device enrollments or manipulation of mobile device management workflows. The vulnerability does not impact integrity or availability directly but has a high confidentiality impact on sensitive secrets.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions 3.10.10, 3.9.24, and 3.8.71. Users should upgrade to these fixed versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary workarounds.