Missing Authorization in Splunk Enterprise - CVE-2026-76251
Published: August 20, 2026
Vulnerability identifier: #VU144429
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76251
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and make limited content changes.
The vulnerability exists due to missing authorization in the Splunk App for Splunk Observability Cloud REST API endpoint handlers when forwarding requests to Splunk Observability Cloud. A remote user can send crafted REST API requests to disclose data available to the stored access token and make limited content changes.
The request can include the Splunk Observability Cloud access token stored for the app.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-76251
Install security update from vendor's website.
Splunk Enterprise - addressed in versions 9.4.14, 10.0.9, 10.2.6, 10.4.2