Splunk Enterprise <=10.4.2/10.2.6 Access Mobile Signing Secrets
CVE-2026-76257 Published on August 19, 2026
Missing Authorization through REST API Endpoints in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access Mobile Device Management signing secrets that compromise all affected mobile-device enrollment trust through Splunk Secure Gateway. The vulnerability is possible because Splunk Secure Gateway Representational State Transfer (REST) API endpoints for deployment bundle, Security Assertion Markup Language setup, and companion app workflows do not require Splunk Secure Gateway administration privileges before processing requests.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-76257 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-76257
stack.watch emails you whenever new vulnerabilities are published in Splunk or Splunk Secure Gateway. Just hit a watch button to start following.
Affected Versions
Splunk Enterprise:- Version 10.4 and below 10.4.2 is affected.
- Version 10.2 and below 10.2.6 is affected.
- Version 10.0 and below 10.0.9 is affected.
- Version 9.4 and below 9.4.14 is affected.
- Version 3.10 and below 3.10.10 is affected.
- Version 3.9 and below 3.9.24 is affected.
- Version 3.8 and below 3.8.71 is affected.