CVE-2026-76265: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. in Splunk Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, multiple REST API endpoints in Splunk Secure Gateway do not enforce proper authorization checks. This flaw allows users lacking the 'admin' or 'power' roles to access privileged functionality, specifically enabling them to cause the Secure Gateway to sign payloads controlled by an attacker.

An attacker with a non-privileged Splunk user account could leverage this vulnerability to have the Splunk Secure Gateway sign arbitrary payloads. This could facilitate further attacks relying on trusted signatures, potentially undermining system integrity. The vulnerability does not impact confidentiality or availability directly but has a high impact on integrity.

Upgrade affected Splunk Enterprise versions to 10.4.3 or later, 10.2.7 or later, 10.0.10 or later, and 9.4.15 or later. For Splunk Secure Gateway, upgrade to versions 3.10.11 or later, 3.9.25 or later, or 3.8.72 or later. These versions include fixes that enforce proper authorization on REST API endpoints. No alternative mitigations are indicated.