CVE-2026-76256 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70. The vulnerability arises from insufficient authorization enforcement on Security Assertion Markup Language setup and instance settings REST API endpoints in Splunk Secure Gateway. Users without the 'admin' or 'power' roles can access sensitive configuration data that should be restricted. This is classified as an information disclosure vulnerability (CWE-200) with a CVSS 3.1 base score of 4.3 (medium severity).

An attacker with low-privileged Splunk user access can read sensitive SAML setup and instance configuration information, potentially aiding further attacks or reconnaissance. There is no impact on integrity or availability reported, and no known exploits in the wild.

The vulnerability is fixed in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions 3.10.9, 3.9.23, and 3.8.70. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly confirmed in the provided data, but the version boundaries indicate fixed versions. No alternative mitigations are described.