CVE-2026-76274

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10

Description An issue exists in the Splunk App for Splunk Observability Cloud where the application does not fully validate the destination of outbound requests. A user with the read o11y content capability can exploit this via the REST API to redirect an outbound request to a host controlled by an attacker, leading to the disclosure of the configured Observability Cloud API token. This is a Server-Side Request Forgery (SSRF), which occurs when an attacker induces a server-side application to make requests to an unintended location.

Recommendations Update Splunk Enterprise to version 10.4.3 or later. Update Splunk Enterprise to version 10.2.7 or later. Update Splunk Enterprise to version 10.0.10 or later.