CVE-2026-76347: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise and Splunk Secure Gateway, the web server processes URLs from upstream components without sufficient validation to ensure requests target expected destinations. This SSRF vulnerability enables non-privileged users to send internal authenticated requests through report notifications, potentially altering Search Head Cluster state and causing denial of service. The root cause is the lack of validation of report notification path values before sending internal requests.

An attacker with limited privileges (not holding admin or power roles) can exploit this SSRF vulnerability to send authenticated requests internally, which may result in unauthorized modifications to the Search Head Cluster state and cause denial of service. There is no confidentiality impact reported. The overall severity is medium with a CVSS score of 5.4.

Fixed versions are available for both Splunk Enterprise and Splunk Secure Gateway. Users should upgrade to versions 10.4.2 or later, 10.2.6 or later, 10.0.9 or later, and 9.4.14 or later for Splunk Enterprise; and 3.10.9 or later, 3.9.23 or later, and 3.8.70 or later for Splunk Secure Gateway. Applying these official fixes will remediate the vulnerability.