Insecure Default Initialization of Resource in Splunk Secure Gateway - CVE-2026-76276
Published: October 12, 2026
Vulnerability identifier: #VU154111
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76276
CWE-ID: CWE-1188
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to retrieve original source code for the Discover Splunk Observability Cloud app.
The vulnerability exists due to insecure production configuration in the app's JavaScript bundles when exposing embedded source maps containing original source code through Splunk Web. A remote user can retrieve the production JavaScript bundles through Splunk Web to retrieve original source code for the Discover Splunk Observability Cloud app.
Exploitation does not require the admin or power Splunk roles.
Affected software
Splunk Secure Gateway
Splunk Enterprise
Splunk Enterprise
How to mitigate CVE-2026-76276
Install security update from vendor's website.
Splunk Secure Gateway - addressed in versions 3.8.72, 3.9.25, 3.10.11
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3