CVE-2026-76258

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.10 Splunk Secure Gateway versions prior to 3.9.24 Splunk Secure Gateway versions prior to 3.8.71

Description A user without "admin" or "power" roles can register an arbitrary companion app. This occurs because the Splunk Secure Gateway companion app registration handler uses a hard-coded cryptographic key, allowing unrestricted registration of callback URLs. Consequently, Splunk Secure Gateway may forward mobile user requests, including tokens that compromise all data available to the affected user, to an attacker-controlled Uniform Resource Locator (URL).

Recommendations Update Splunk Enterprise to version 10.4.2 or later. Update Splunk Enterprise to version 10.2.6 or later. Update Splunk Enterprise to version 10.0.9 or later. Update Splunk Enterprise to version 9.4.14 or later. Update Splunk Secure Gateway to version 3.10.10 or later. Update Splunk Secure Gateway to version 3.9.24 or later. Update Splunk Secure Gateway to version 3.8.71 or later.