In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user lacking admin or power roles can read Spacebridge asymmetric private keys stored in the app collection via the Splunk Secure Gateway App Key Value Store REST API. This vulnerability arises when an instance is upgraded from older Splunk Secure Gateway deployments but the private-key migration remains incomplete, resulting in key material being stored with an insecure default access control list. This exposure compromises the confidentiality of Spacebridge private-key material. The vulnerability is tracked as CVE-2026-76261 with a CVSS 3.1 base score of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

An attacker with low privileges (non-admin, non-power roles) can read sensitive asymmetric private keys used by Spacebridge, potentially compromising the confidentiality of cryptographic material. This could undermine the security of communications or authentication relying on these keys. There is no indication of integrity or availability impact. The vulnerability requires that the private-key migration from older deployments is incomplete, which is a prerequisite for exploitation.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation involves ensuring that private-key migration is complete after upgrading from older Splunk Secure Gateway deployments to prevent key material from remaining accessible with insecure default access controls. Restricting access to the Key Value Store REST API and verifying role permissions may reduce exposure until an official fix is applied.