Improper Authorization in Splunk Secure Gateway - CVE-2026-76275
Published: October 12, 2026
Vulnerability identifier: #VU154110
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76275
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose search query text and job metadata belonging to other users.
The vulnerability exists due to improper authorization in REST API search job listings when including job information without fully enforcing per-user authorization. A remote user can retrieve search job listings through the REST API to disclose search query text and job metadata belonging to other users.
Accessible metadata includes job identifiers, dispatch parameters, result counts, and execution metadata. Exploitation does not require the admin or power Splunk roles.
Affected software
Splunk Secure Gateway
Splunk Enterprise
Splunk Enterprise
How to mitigate CVE-2026-76275
Install security update from vendor's website.
Splunk Secure Gateway - addressed in versions 3.8.72, 3.9.25, 3.10.11
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3