CVE-2026-76251

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9

Description A user without admin or power roles can force the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the stored access token. This allows the user to view data associated with the token and make limited changes to the content. The issue occurs because the Representational State Transfer (REST) API endpoint handlers fail to enforce the read o11y content capability before forwarding requests.

Recommendations Update Splunk Enterprise to version 10.4.2 or later. Update Splunk Enterprise to version 10.2.6 or later. Update Splunk Enterprise to version 10.0.9 or later.