CVE-2026-76261: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. in Splunk Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a vulnerability exists where users lacking admin or power roles can read Spacebridge asymmetric private keys. This is possible when instances upgraded from older Splunk Secure Gateway deployments have incomplete private-key migration, leaving key material stored in a collection with insecure default access control lists accessible through the Splunk Secure Gateway App Key Value Store REST API. The exposure of these private keys compromises the confidentiality of Spacebridge private-key material.

The vulnerability allows unauthorized users with limited privileges to read sensitive asymmetric private keys used by Spacebridge, potentially compromising the confidentiality of cryptographic material. There is no indication of integrity or availability impact. Exploitation requires that the private-key migration is incomplete, which is a condition present in upgraded instances from older deployments.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions 3.10.9, 3.9.23, and 3.8.70. Users should upgrade to these or later versions to remediate the vulnerability. The vulnerability arises from incomplete private-key migration; completing the migration process and ensuring proper access control lists on key material collections will mitigate the issue.