CVE-2026-76258

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile user requests, including tokens that compromise all relevant data available to the affected mobile user, to an attacker-controlled Uniform Resource Locator (URL). The vulnerability is possible because a hard-coded cryptographic key in the Splunk Secure Gateway companion app registration handler allows for arbitrary callback URL registration without restriction. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2026-0801	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*

Configuration 2 (hide)

OR	cpe:2.3:a:splunk:splunk_secure_gateway::::::::
	cpe:2.3:a:splunk:splunk_secure_gateway::::::::
	cpe:2.3:a:splunk:splunk_secure_gateway::::::::

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) En versiones de Splunk Enterprise anteriores a 10.4.2, 10.2.6, 10.0.9 y 9.4.14, y versiones de Splunk Secure Gateway anteriores a 3.10.10, 3.9.24 y 3.8.71, un usuario que no posee los roles de Splunk ’admin’ o ’power’ podría registrar una aplicación complementaria arbitraria y hacer que Splunk Secure Gateway reenvíe solicitudes de usuarios móviles, incluyendo tokens que comprometen todos los datos relevantes disponibles para el usuario móvil afectado, a un Uniform Resource Locator (URL) controlado por un atacante. La vulnerabilidad es posible porque una clave criptográfica codificada de forma rígida en el gestor de registro de la aplicación complementaria de Splunk Secure Gateway permite el registro arbitrario de URL de devolución de llamada sin restricciones. Para más información, consulte Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) en la documentación de Splunk.

Information

Published : 2026-08-19 22:17

Updated : 2026-10-26 10:10

NVD link : CVE-2026-76258

Mitre link : CVE-2026-76258

CVE.ORG link : CVE-2026-76258

JSON object : View

Products Affected

splunk

splunk_secure_gateway
splunk

CWE

CWE-321

Use of Hard-coded Cryptographic Key

6.5 /10