Authorization bypass through user-controlled key in Splunk Secure Gateway - CVE-2026-76269
Published: October 12, 2026
Vulnerability identifier: #VU154104
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76269
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose other users' search job information.
The vulnerability exists due to incomplete job ownership validation in REST API search job retrieval when returning information for a user-supplied job identifier. A remote user can supply an identifier for another user's job to disclose other users' search job information.
Accessible information includes search query text, job metadata, results, and preview results. Exploitation does not require the admin or power Splunk roles.
Affected software
Splunk Secure Gateway
Splunk Enterprise
Splunk Enterprise
How to mitigate CVE-2026-76269
Install security update from vendor's website.
Splunk Secure Gateway - addressed in versions 3.8.72, 3.9.25, 3.10.11
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3