CVE-2026-76272: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

The vulnerability arises because Splunk Secure Gateway does not verify that a user requesting a signature is authorized to do so. Consequently, users lacking the 'admin' or 'power' roles can cause the gateway to sign payloads they control. This issue affects multiple versions of Splunk Enterprise and Splunk Secure Gateway as specified. The CVSS v3.1 score is 4.3, indicating a medium severity with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker with low privileges but without admin or power roles can cause the Splunk Secure Gateway to sign arbitrary payloads. This could lead to integrity issues where attacker-controlled data is trusted due to the signature. There is no direct confidentiality or availability impact reported.

A fix is available in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 and in Splunk Secure Gateway versions 3.10.11, 3.9.25, and 3.8.72. Users should upgrade to these or later versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.