CVE-2026-76276: The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure. in Splunk Splunk Enterprise

In affected Splunk Enterprise versions, production JavaScript bundles for the Discover Splunk Observability Cloud app contain embedded source maps that expose the original source code. Low-privileged users lacking admin or power roles can retrieve this source code through Splunk Web. The vulnerability arises from insecure default settings that were intended to be changed by administrators but were not. This exposure does not allow modification or denial of service but leaks source code, which may aid attackers in further analysis.

The vulnerability allows disclosure of original source code of the Discover Splunk Observability Cloud app to low-privileged users without elevated roles. This could potentially aid attackers in understanding application internals but does not directly impact confidentiality of user data, integrity, or availability. The CVSS score is 4.3 (medium severity), reflecting limited confidentiality impact and no integrity or availability impact.

A fix is available in Splunk Enterprise versions 10.4.3, 10.2.7, and 10.0.10. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation steps are indicated by the vendor advisory. Splunk Enterprise 9.4.x versions are not affected and do not require action.