CVE-2026-76261

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway versions prior to 3.9.23 Splunk Secure Gateway versions prior to 3.8.70

Description Users without admin or power roles can read Spacebridge asymmetric private keys through the Splunk Secure Gateway App Key Value Store REST API. This occurs on instances upgraded from older Splunk Secure Gateway deployments where private-key migration is incomplete, resulting in key material being stored in a collection with an insecure default access control list.

Recommendations Update Splunk Enterprise to version 10.4.2 or later. Update Splunk Enterprise to version 10.2.6 or later. Update Splunk Enterprise to version 10.0.9 or later. Update Splunk Enterprise to version 9.4.14 or later. Update Splunk Secure Gateway to version 3.10.9 or later. Update Splunk Secure Gateway to version 3.9.23 or later. Update Splunk Secure Gateway to version 3.8.70 or later.