In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the rest_properties_get capability could read… (CVE-2026-76260)

CVE-2026-76260 is a vulnerability in Splunk Enterprise where the REST API endpoint for properties allows users with the rest_properties_get capability to read encrypted stored credentials. The issue stems from improper permission assignment: the endpoint requires rest_properties_get capability rather than the intended list_storage_passwords capability. This misconfiguration enables users with less privileged roles to access sensitive credential data. The vulnerability affects versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The CVSS 3.1 base score is 6.5, indicating a moderate severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No known exploits are reported in the wild. No patch links or vendor advisory details are provided in the input data.

Successful exploitation allows a user with the rest_properties_get capability to read encrypted stored credentials, potentially exposing sensitive data protected by those credentials. This could lead to unauthorized access to systems or data that rely on those stored credentials. The vulnerability does not impact integrity or availability directly but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should review role capabilities and restrict the rest_properties_get capability to trusted roles only. Monitor Splunk's official documentation and advisories for updates on fixes or official mitigations. Avoid assigning rest_properties_get capability to roles that do not require access to stored credentials.