Threat Intelligence Database

A vulnerability in Splunk Enterprise and Splunk Secure Gateway allows users without admin or power roles to read Spacebridge asymmetric private keys via the Splunk Secure Gateway App Key Value Store REST API. This occurs on instances upgraded from older deployments where private-key migration is incomplete, leaving key material accessible due to insecure default access controls. The issue affects versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 for Splunk Enterprise, and below 3.10.9, 3.9.23, and 3.8.70 for Splunk Secure Gateway. The vulnerability has a CVSS score of 5.3 (medium severity).

CVE-2026-76257 is a vulnerability in Splunk Enterprise and Splunk Secure Gateway where users with permissions to list storage passwords but without Secure Gateway admin privileges can access Mobile Device Management signing secrets. This occurs because certain Splunk Secure Gateway REST API endpoints do not enforce admin privilege checks before processing requests, potentially compromising mobile-device enrollment trust.

CVE-2026-76261 affects certain versions of Splunk Enterprise and Splunk Secure Gateway. It allows users without admin or power roles to read Spacebridge asymmetric private keys via the Splunk Secure Gateway App Key Value Store REST API if the private-key migration from older deployments is incomplete. This occurs due to insecure default access control lists on key material collections. The vulnerability is rated medium severity with a CVSS score of 5.3.

CVE-2026-76257 is a vulnerability in Splunk Enterprise and Splunk Secure Gateway where certain REST API endpoints do not enforce proper authorization checks. This allows users with roles that can list storage passwords, but without Secure Gateway admin privileges, to access Mobile Device Management signing secrets. The flaw affects multiple versions of Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, as well as Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71. The vulnerability could compromise mobile-device enrollment trust. The CVSS score is 6.5 (medium severity).

CVE-2026-76256 is a medium severity vulnerability in Splunk Enterprise and Splunk Secure Gateway where users without admin or power roles can access sensitive Security Assertion Markup Language (SAML) setup and instance settings via certain REST API endpoints. This occurs because the affected endpoints do not properly enforce authorization checks before returning configuration data. The issue affects multiple versions of Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, as well as Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70. The vulnerability allows unauthorized information disclosure but does not impact integrity or availability. No known exploits are reported in the wild. Patch status is not explicitly stated in the provided data, so users should consult vendor advisories for remediation guidance.