CVE-2026-76274: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. in Splunk Splunk Enterprise

The vulnerability arises because the Splunk App for Splunk Observability Cloud does not sufficiently validate the destination of outbound REST API requests. A user holding the read_o11y_content capability can exploit this by redirecting such requests to an attacker-controlled server, thereby exposing the Observability Cloud API token configured in the system. This affects Splunk Enterprise versions >=10.0 <10.0.10, >=10.2 <10.2.7, and >=10.4 <10.4.3. Versions 9.4.x are not vulnerable.

An attacker with read_o11y_content capability can cause Splunk Enterprise to send sensitive API tokens to an attacker-controlled host, resulting in disclosure of authentication credentials. This could potentially allow unauthorized access to the Observability Cloud services. The vulnerability does not affect system integrity or availability directly but compromises confidentiality of API tokens.

Splunk has released fixed versions 10.0.10, 10.2.7, and 10.4.3 that address this issue. Users should upgrade affected Splunk Enterprise instances to these versions or later to remediate the vulnerability. No other mitigation or temporary fix is indicated in the advisory.