CVE-2026-76260: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. in Splunk Splunk Enterprise

In Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the REST API endpoint for properties requires the rest_properties_get capability instead of the more restrictive list_storage_passwords capability to read encrypted stored credentials. This misconfiguration allows users holding the rest_properties_get capability to access encrypted stored credentials, potentially exposing sensitive data. The vulnerability arises from incorrect permission assignments on a security-critical resource.

An attacker with a role that includes the rest_properties_get capability can read encrypted stored credentials through the REST API. This exposure can lead to unauthorized access to sensitive data protected by these credentials. The vulnerability does not allow modification or denial of service but compromises confidentiality of stored credentials.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Until upgraded, review and restrict roles that include the rest_properties_get capability to trusted users only. Follow Splunk's official documentation on defining roles and capabilities to ensure proper permission assignment.