CVE-2026-76351: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) and Splunk Secure Gateway (below 3.10.9, 3.9.23, and 3.8.70), a user lacking admin or power roles can leverage crafted report notification data to trick the Secure Gateway into sending requests to the Splunk Enterprise REST API with a system-level session token. This vulnerability stems from insufficient validation of decoded report notification identifiers, enabling unauthorized configuration changes and session token theft without requiring a password.

An attacker with limited privileges can escalate their access by obtaining a system-level session token without authentication, allowing them to modify Splunk platform configurations and access all relevant data. This compromises system integrity, confidentiality, and availability, representing a critical risk to affected environments.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions 3.10.9, 3.9.23, and 3.8.70. Users should upgrade to these or later versions to remediate the vulnerability. No alternative mitigations are indicated in the advisory.