Authorization bypass through user-controlled key in Splunk Secure Gateway - CVE-2026-76278
Published: October 12, 2026
Vulnerability identifier: #VU154113
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76278
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose permission grants for SPL2 modules they are not authorized to view.
The vulnerability exists due to improper authorization in the SPL2 module permissions REST API when returning permission grants without verifying read access to the requested app. A remote user can request permission grants through the affected REST API to disclose permission grants for SPL2 modules they are not authorized to view.
Exploitation requires a role with the edit_spl2_module_permissions capability.
Affected software
Splunk Secure Gateway
Splunk Enterprise
Splunk Enterprise
How to mitigate CVE-2026-76278
Install security update from vendor's website.
Splunk Secure Gateway - addressed in versions 3.8.72, 3.9.25, 3.10.11
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3
Splunk Enterprise - addressed in versions 9.4.15, 10.0.10, 10.2.7, 10.4.3