In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the… (CVE-2026-76340)

In Splunk Enterprise 10.4 versions below 10.4.2, the REST API allows unauthenticated users to reload token-signing keys due to missing authentication and capability checks on the token-key reload action. This vulnerability (CVE-2026-76340) arises because the REST API endpoint responsible for this action does not enforce authentication or require the change_authentication capability, enabling unauthorized integrity modification. Versions prior to 10.4 are not affected. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is present.

An unauthenticated attacker can cause Splunk Enterprise to reload token-signing keys without authorization, potentially affecting the integrity of token validation processes. There is no direct confidentiality or availability impact reported. The vulnerability could allow unauthorized changes to token-signing keys, which may affect authentication mechanisms relying on these keys.

Splunk has fixed this vulnerability in version 10.4.2. Users should upgrade to Splunk Enterprise 10.4.2 or later to remediate this issue. Since no patch links or vendor advisory text is provided, patch status is inferred from the version information in the description. No other mitigations are indicated.