CVE-2026-76256

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway versions prior to 3.9.23 Splunk Secure Gateway versions prior to 3.8.70

Description Users without "admin" or "power" roles can access sensitive Security Assertion Markup Language (SAML) setup and instance settings. This occurs because the Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce proper authorization requirements before returning configuration data.

Recommendations Update Splunk Enterprise to version 10.4.2 or later. Update Splunk Enterprise to version 10.2.6 or later. Update Splunk Enterprise to version 10.0.9 or later. Update Splunk Enterprise to version 9.4.14 or later. Update Splunk Secure Gateway to version 3.10.9 or later. Update Splunk Secure Gateway to version 3.9.23 or later. Update Splunk Secure Gateway to version 3.8.70 or later.