SB2026101252 - Multiple vulnerabilities in Splunk Secure Gateway
Published: October 12, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2026-76272)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to obtain unauthorized signatures for attacker-controlled payloads.
The vulnerability exists due to missing authorization in Splunk Secure Gateway signature functionality when handling REST API signature requests. A remote user can request signatures for attacker-controlled payloads to obtain unauthorized signatures for attacker-controlled payloads.
Exploitation does not require the admin or power Splunk roles.
2) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-76280)
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify Splunk Secure Gateway alert and mobile-device recipient data without authorization.
The vulnerability exists due to incorrect permission assignment in Splunk Secure Gateway App KV Store collections when allowing unrestricted writes instead of limiting them to authorized workflows. A remote user can write to the affected collections to modify Splunk Secure Gateway alert and mobile-device recipient data without authorization.
The data is subsequently used by alert and subscription workflows. Exploitation does not require the admin or sc_admin Splunk roles.
3) Input validation error (CVE-ID: CVE-2026-76279)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to write events to internal indexes outside their role's configured index access.
The vulnerability exists due to improper input validation in the collect SPL command when applying role-based index-access restrictions without normalizing whitespace in an index name. A remote user can supply an index name containing crafted whitespace to the collect command to write events to internal indexes outside their role's configured index access.
Exploitation requires a role with the run_collect capability.
4) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-76278)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose permission grants for SPL2 modules they are not authorized to view.
The vulnerability exists due to improper authorization in the SPL2 module permissions REST API when returning permission grants without verifying read access to the requested app. A remote user can request permission grants through the affected REST API to disclose permission grants for SPL2 modules they are not authorized to view.
Exploitation requires a role with the edit_spl2_module_permissions capability.
5) Input validation error (CVE-ID: CVE-2026-76277)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to cause distinct native Splunk accounts to share configuration data and disrupt user-management operations.
The vulnerability exists due to improper input validation in native Splunk username validation when using a username ending with a period for a user directory. A remote privileged user can create a native Splunk username with a trailing period through the REST API to cause distinct native Splunk accounts to share configuration data and disrupt user-management operations.
Exploitation requires the edit_user capability. User-management operations can affect the wrong account or fail.
6) Insecure Default Initialization of Resource (CVE-ID: CVE-2026-76276)
CWE-ID: CWE-1188 - Insecure Default Initialization of Resource
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to retrieve original source code for the Discover Splunk Observability Cloud app.
The vulnerability exists due to insecure production configuration in the app's JavaScript bundles when exposing embedded source maps containing original source code through Splunk Web. A remote user can retrieve the production JavaScript bundles through Splunk Web to retrieve original source code for the Discover Splunk Observability Cloud app.
Exploitation does not require the admin or power Splunk roles.
7) Improper Authorization (CVE-ID: CVE-2026-76275)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose search query text and job metadata belonging to other users.
The vulnerability exists due to improper authorization in REST API search job listings when including job information without fully enforcing per-user authorization. A remote user can retrieve search job listings through the REST API to disclose search query text and job metadata belonging to other users.
Accessible metadata includes job identifiers, dispatch parameters, result counts, and execution metadata. Exploitation does not require the admin or power Splunk roles.
8) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-76274)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose the configured Observability Cloud API token.
The vulnerability exists due to server-side request forgery in Splunk App for Splunk Observability Cloud when processing REST API requests without fully validating outbound request destinations. A remote user can redirect an outbound request to an attacker-controlled host to disclose the configured Observability Cloud API token.
Exploitation requires a role with the read_o11y_content capability.
9) Input validation error (CVE-ID: CVE-2026-76273)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to add attacker-controlled content to system-level messages.
The vulnerability exists due to improper input validation in the collect SPL command when processing an index name. A remote user can supply a crafted index name to the collect command to add attacker-controlled content to system-level messages.
Exploitation requires a role with the run_collect capability.
10) Incorrect authorization (CVE-ID: CVE-2026-76264)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to create or edit scripted lookup definitions without authorization.
The vulnerability exists due to improper authorization in raw transforms configuration write paths when saving scripted lookup settings. A remote user can submit configuration changes through raw configuration endpoints to create or edit scripted lookup definitions without authorization.
Exploitation does not require the admin or power Splunk roles.
11) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-76271)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in a REST API endpoint of the Discover Splunk Observability Cloud app when validating submitted input. A remote user can submit crafted input to the affected endpoint to cause a denial of service.
The denial of service targets the affected REST API endpoint. Exploitation does not require the admin or power Splunk roles.
12) SQL injection (CVE-ID: CVE-2026-76270)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose private SPL2 module definitions belonging to other users.
The vulnerability exists due to SQL injection in SPL2 module catalog filtering when using unparameterized user-supplied values in database queries. A remote user can submit crafted filtering values through the affected REST API to disclose private SPL2 module definitions belonging to other users.
Exploitation requires a role with the list_spl2_modules capability. Access extends to all relevant data available through the affected API.
13) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-76269)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose other users' search job information.
The vulnerability exists due to incomplete job ownership validation in REST API search job retrieval when returning information for a user-supplied job identifier. A remote user can supply an identifier for another user's job to disclose other users' search job information.
Accessible information includes search query text, job metadata, results, and preview results. Exploitation does not require the admin or power Splunk roles.
14) Missing Authentication for Critical Function (CVE-ID: CVE-2026-76268)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary operating-system commands.
The vulnerability exists due to missing authentication for critical configuration operations in the Patroni REST API when handling configuration requests. A remote attacker can invoke critical configuration operations without authentication to execute arbitrary operating-system commands.
Exploitation requires network access to the Patroni REST API on a search head cluster member.
15) Improper Output Neutralization for Logs (CVE-ID: CVE-2026-76267)
CWE-ID: CWE-117 - Improper Output Neutralization for Logs
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject forged entries into the app log.
The vulnerability exists due to improper neutralization of log content in Splunk App for Splunk O11y Cloud when writing user-supplied SignalFlow content to the app log. A remote user can submit crafted SignalFlow content through the REST API to inject forged entries into the app log.
Exploitation requires a role with the read_o11y_content capability.
16) Improper privilege management (CVE-ID: CVE-2026-76266)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to execute arbitrary operating-system commands with root privileges.
The vulnerability exists due to improper privilege management in the Linux package maintainer script when performing upgrade operations with root privileges while trusting existing installation content. A local privileged user can modify the Splunk Enterprise installation before an affected Linux package upgrade to execute arbitrary operating-system commands with root privileges.
Exploitation requires the ability to run commands as the account running Splunk Enterprise and a subsequent package upgrade initiated through user interaction. Privileges cannot be elevated at will.
17) Improper access control (CVE-ID: CVE-2026-76265)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access privileged Splunk Secure Gateway functionality and obtain signatures for attacker-controlled payloads.
The vulnerability exists due to improper access control in multiple Splunk Secure Gateway REST API endpoints when processing requests without enforcing authorization requirements. A remote user can submit attacker-controlled payloads to the affected endpoints to access privileged Splunk Secure Gateway functionality and obtain signatures for attacker-controlled payloads.
Exploitation does not require the admin or power Splunk roles.
Remediation
Install update from vendor's website.