CVE-2026-76258: The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. in Splunk Splunk Enterprise

This vulnerability arises from the use of a hard-coded cryptographic key in the Splunk Secure Gateway companion app registration handler. It enables users without admin or power roles to register arbitrary companion apps, allowing forwarding of mobile user requests and tokens to attacker-controlled URLs. This flaw affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions prior to 3.10.10, 3.9.24, and 3.8.71. The vulnerability increases the risk that encrypted data may be recovered by unauthorized parties.

An attacker with limited privileges (non-admin/non-power user) can exploit this vulnerability to register arbitrary companion apps that forward mobile user requests and tokens to attacker-controlled URLs. This compromises the confidentiality of all relevant data accessible to the affected mobile user. The CVSS score of 6.5 (medium severity) reflects a network attack vector with low complexity and no user interaction required, resulting in high confidentiality impact but no integrity or availability impact.

Fixed versions are available for both Splunk Enterprise and Splunk Secure Gateway. Users should upgrade to at least versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 for Splunk Enterprise, and 3.10.10, 3.9.24, or 3.8.71 for Splunk Secure Gateway. Applying these official fixes will remediate the vulnerability. No additional mitigation steps are indicated in the vendor advisory.