CVE-2026-76261: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. in Splunk Splunk Enterprise
CVE-2026-76261 affects Splunk Enterprise and Splunk Secure Gateway versions prior to specified fixed releases. It allows users without admin or power roles to read sensitive Spacebridge asymmetric private keys via the Splunk Secure Gateway App Key Value Store REST API. This occurs when an upgrade from older Secure Gateway deployments leaves private-key migration incomplete, resulting in insecure default access control lists on key material collections. The vulnerability has a medium severity with a CVSS score of 5.3.
AI Analysis
Technical Summary
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a vulnerability exists where users lacking admin or power roles can access Spacebridge asymmetric private keys. This is due to incomplete private-key migration during upgrades from older Secure Gateway deployments, leaving key material accessible through the Splunk Secure Gateway App Key Value Store REST API with insecure default access control lists. This exposure compromises the confidentiality of critical private-key material.
Potential Impact
Unauthorized users with lower privilege roles can read sensitive asymmetric private keys used by Spacebridge, potentially compromising the confidentiality of encrypted communications or authentication mechanisms relying on these keys. The vulnerability does not allow modification or denial of service but poses a significant confidentiality risk.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and complete the private-key migration process after upgrades to ensure that key material is not left accessible with insecure permissions. Restrict access to the Splunk Secure Gateway App Key Value Store REST API to trusted roles only.
CVE-2026-76261: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. in Splunk Splunk Enterprise
Description
CVE-2026-76261 affects Splunk Enterprise and Splunk Secure Gateway versions prior to specified fixed releases. It allows users without admin or power roles to read sensitive Spacebridge asymmetric private keys via the Splunk Secure Gateway App Key Value Store REST API. This occurs when an upgrade from older Secure Gateway deployments leaves private-key migration incomplete, resulting in insecure default access control lists on key material collections. The vulnerability has a medium severity with a CVSS score of 5.3.
CVSS v3.1
Score 5.3medium
Affected software
pkg:github/splunk/splunk-secure-gatewayRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a vulnerability exists where users lacking admin or power roles can access Spacebridge asymmetric private keys. This is due to incomplete private-key migration during upgrades from older Secure Gateway deployments, leaving key material accessible through the Splunk Secure Gateway App Key Value Store REST API with insecure default access control lists. This exposure compromises the confidentiality of critical private-key material.
Potential Impact
Unauthorized users with lower privilege roles can read sensitive asymmetric private keys used by Spacebridge, potentially compromising the confidentiality of encrypted communications or authentication mechanisms relying on these keys. The vulnerability does not allow modification or denial of service but poses a significant confidentiality risk.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and complete the private-key migration process after upgrades to ensure that key material is not left accessible with insecure permissions. Restrict access to the Splunk Secure Gateway App Key Value Store REST API to trusted roles only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2026-08-19T12:02:03.619Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a862251acd9273b49a6fd9b
Added to database: 08/19/2026, 21:38:25 UTC
Last enriched: 08/19/2026, 22:53:16 UTC
Last updated: 08/20/2026, 00:52:18 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.