Threats Tagged 'cve-2026-76256'

Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise, specifiek in versies vóór 10.4.2, 10.2.6, 10.0.9 en 9.4.14.

A vulnerability in Splunk Enterprise and Splunk Secure Gateway versions prior to specified fixed releases allows non-admin and non-power users to read sensitive Security Assertion Markup Language (SAML) setup and instance settings via certain REST API endpoints. This occurs because these endpoints do not enforce proper authorization checks before returning configuration information.

CVE-2026-76256 is a medium severity vulnerability in Splunk Enterprise and Splunk Secure Gateway where users without admin or power roles can access sensitive Security Assertion Markup Language (SAML) setup and instance settings via certain REST API endpoints. This occurs because the affected endpoints do not properly enforce authorization checks before returning configuration data. The issue affects multiple versions of Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, as well as Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70. The vulnerability allows unauthorized information disclosure but does not impact integrity or availability. No known exploits are reported in the wild. Patch status is not explicitly stated in the provided data, so users should consult vendor advisories for remediation guidance.