CVE-2026-76258
Full vulnerability record from the local CVENow database.
Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile user requests, including tokens that compromise all relevant data available to the affected mobile user, to an attacker-controlled Uniform Resource Locator (URL). The vulnerability is possible because a hard-coded cryptographic key in the Splunk Secure Gateway companion app registration handler allows for arbitrary callback URL registration without restriction. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-19 22:17:13.793000
Last modified
2026-10-26 10:10:00.140000
View original CVE JSON
{
"id": "CVE-2026-76258",
"sourceIdentifier": "[email protected]",
"published": "2026-08-19T22:17:13.793",
"lastModified": "2026-10-26T10:10:00.140",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the \"admin\" or \"power\" Splunk roles could register an arbitrary companion app and cause Splunk Secure Gateway to forward mobile user requests, including tokens that compromise all relevant data available to the affected mobile user, to an attacker-controlled Uniform Resource Locator (URL). The vulnerability is possible because a hard-coded cryptographic key in the Splunk Secure Gateway companion app registration handler allows for arbitrary callback URL registration without restriction. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation."
},
{
"lang": "es",
"value": "En versiones de Splunk Enterprise anteriores a 10.4.2, 10.2.6, 10.0.9 y 9.4.14, y versiones de Splunk Secure Gateway anteriores a 3.10.10, 3.9.24 y 3.8.71, un usuario que no posee los roles de Splunk ’admin’ o ’power’ podría registrar una aplicación complementaria arbitraria y hacer que Splunk Secure Gateway reenvíe solicitudes de usuarios móviles, incluyendo tokens que comprometen todos los datos relevantes disponibles para el usuario móvil afectado, a un Uniform Resource Locator (URL) controlado por un atacante. La vulnerabilidad es posible porque una clave criptográfica codificada de forma rígida en el gestor de registro de la aplicación complementaria de Splunk Secure Gateway permite el registro arbitrario de URL de devolución de llamada sin restricciones. Para más información, consulte Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) en la documentación de Splunk."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"modules": [
"Splunk Secure Gateway"
],
"versions": [
{
"version": "10.4",
"lessThan": "10.4.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.2",
"lessThan": "10.2.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0",
"lessThan": "10.0.9",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.4",
"lessThan": "9.4.14",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Splunk",
"product": "Splunk Secure Gateway",
"versions": [
{
"version": "3.10",
"lessThan": "3.10.10",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.9",
"lessThan": "3.9.24",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.8",
"lessThan": "3.8.71",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-26T14:49:11.029125Z",
"id": "CVE-2026-76258",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-321"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.4.0",
"versionEndExcluding": "9.4.14",
"matchCriteriaId": "E180CC4C-5B8B-4D69-8535-93DCF3510119"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndExcluding": "10.0.9",
"matchCriteriaId": "0FD75354-A6EE-49F9-9B8A-31287A845CFB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.2.0",
"versionEndExcluding": "10.2.6",
"matchCriteriaId": "C8FDA841-04BC-404C-B56D-7869CBD8B56C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.4.0",
"versionEndExcluding": "10.4.2",
"matchCriteriaId": "209C1DE6-893D-424D-B103-B64A314AD8DC"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.8.0",
"versionEndExcluding": "3.8.71",
"matchCriteriaId": "B30F23F9-3337-4DE3-8F91-B9B54EC5CA19"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.9.0",
"versionEndExcluding": "3.9.24",
"matchCriteriaId": "05B1F48C-70F7-4455-9BE9-613943727644"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.0",
"versionEndExcluding": "3.10.10",
"matchCriteriaId": "48361782-396C-4DBD-96BF-0131DF4D5DF4"
}
]
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0801",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}