CVE-2026-76262: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. in Splunk Splunk Enterprise

In Splunk Enterprise versions >=10.4 and <10.4.2, the Prometheus metrics endpoint in the Edge Processor SPL2 Preview sidecar does not require authentication. This allows unauthenticated actors to read service metrics that include runtime and build metadata, exposing sensitive information. The vulnerability does not affect versions below 10.4. The root cause is the absence of authentication on the metrics endpoint, enabling any client with network access to the sidecar to retrieve these metrics without credentials.

An unauthenticated attacker with network access to the Edge Processor SPL2 Preview sidecar can obtain sensitive runtime and build metadata information from the Prometheus metrics endpoint. This information disclosure could aid attackers in further reconnaissance or targeted attacks. There is no impact on integrity or availability, only confidentiality is affected.

Splunk Enterprise versions 10.4.2 and later include a fix for this vulnerability. Users should upgrade to version 10.4.2 or later to remediate the issue. Since this is not a cloud service, remediation requires applying the official patch. No other mitigation steps are indicated in the vendor advisory.