Splunk SG KV Store: Low-Privileged Read via REST API (v<10.4.4/3.10.12)
CVE-2026-76292 Published on October 21, 2026
Missing Authorization through REST API Endpoints in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints.
The vulnerability is possible because the affected Splunk Secure Gateway App Key Value Store collections do not enforce user-level authorization for read requests.
For more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-the-app-key-value-store/about-the-app-key-value-store) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-76292 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-76292
stack.watch emails you whenever new vulnerabilities are published in Splunk or Splunk Secure Gateway. Just hit a watch button to start following.
Affected Versions
Splunk Enterprise:- Version 10.4 and below 10.4.4 is affected.
- Version 10.2 and below 10.2.8 is affected.
- Version 10.0 and below 10.0.11 is affected.
- Version 9.4 and below 9.4.16 is affected.
- Version 3.10 and below 3.10.12 is affected.
- Version 3.9 and below 3.9.26 is affected.
- Version 3.8 and below 3.8.73 is affected.