CVE-2026-76340: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In Splunk Enterprise versions >=10.4 and <10.4.2, the REST API permits unauthenticated users to trigger a reload of token-signing keys without performing an authorization check. This occurs because the REST API endpoint responsible for the token-key reload action does not require authentication or the 'change_authentication' capability. This flaw could allow an attacker to interfere with token management processes, potentially impacting integrity but not confidentiality or availability.

The vulnerability allows an unauthenticated attacker to cause Splunk Enterprise to reload token-signing keys. According to the CVSS vector, this does not compromise confidentiality or availability but can impact integrity. There is no indication of active exploitation in the wild. The impact is limited to the ability to reload keys without authorization, which could disrupt token-based authentication mechanisms.

A fixed version, 10.4.2, is available that addresses this vulnerability. Users should upgrade to Splunk Enterprise version 10.4.2 or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.