CVE-2026-76351 Splunk CVE debrief

Who should care

Splunk Secure Gateway and Splunk Enterprise administrators, security teams, and users with access to report notification data should be aware of this vulnerability. They should review system logs for suspicious activity, monitor for unusual behavior, and apply vendor patches to affected versions. Additionally, they should restrict access to Splunk platform configuration and implement compensating controls for session token management. This includes reviewing and updating access controls, monitoring for signs of session token misuse, and verifying the integrity of system configurations.

Technical summary

The vulnerability is caused by Splunk Secure Gateway not validating decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API. This allows a user without 'admin' or 'power' roles to modify the Splunk platform configuration and potentially obtain a session token without a password. The issue affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70. To mitigate, apply vendor patches and restrict access to Splunk platform configuration.

Defensive priority

High priority due to potential for configuration modification and session token misuse.

Recommended defensive actions

• Inventory and verify affected Splunk Secure Gateway and Splunk Enterprise versions.
• Apply vendor patches to affected versions.
• Monitor for suspicious report notification data.
• Restrict access to Splunk platform configuration.
• Implement compensating controls for session token management.

Evidence notes

The vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70. A user could obtain a session token without a password and use it to access all relevant data and affect system integrity. This issue is caused by Splunk Secure Gateway not validating decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API. To verify, defenders should review system logs for suspicious report notification data and monitor for unusual activity. Additionally, they should check for signs of session token misuse and review access controls.

Official resources