CVE-2026-76347
Full vulnerability record from the local CVENow database.
Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated requests to internal Splunk services, which could allow for changes to Search Head Cluster state and a denial of service. The vulnerability is possible because Splunk Secure Gateway does not validate report notification path values before it sends internal requests.
Severity
MEDIUM
CVSS score
5.4
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-19 22:17:19.553000
Last modified
2026-10-27 10:10:00.240000
View original CVE JSON
{
"id": "CVE-2026-76347",
"sourceIdentifier": "[email protected]",
"published": "2026-08-19T22:17:19.553",
"lastModified": "2026-10-27T10:10:00.240",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the \"admin\" or \"power\" Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated requests to internal Splunk services, which could allow for changes to Search Head Cluster state and a denial of service. The vulnerability is possible because Splunk Secure Gateway does not validate report notification path values before it sends internal requests."
},
{
"lang": "es",
"value": "En las versiones de Splunk Enterprise anteriores a la 10.4.2, 10.2.6, 10.0.9 y 9.4.14, y en las versiones de Splunk Secure Gateway anteriores a la 3.10.9, 3.9.23 y 3.8.70, un usuario que no posee los roles de Splunk ’admin’ o ’power’ podría usar la falsificación de petición del lado del servidor (SSRF) en las notificaciones de informes para enviar peticiones autenticadas por el sistema a servicios internos de Splunk, lo que podría permitir cambios en el estado del Search Head Cluster y una denegación de servicio. La vulnerabilidad es posible porque Splunk Secure Gateway no valida los valores de la ruta de notificación de informes antes de enviar peticiones internas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"modules": [
"Splunk Secure Gateway"
],
"versions": [
{
"version": "10.4",
"lessThan": "10.4.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.2",
"lessThan": "10.2.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0",
"lessThan": "10.0.9",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.4",
"lessThan": "9.4.14",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Splunk",
"product": "Splunk Secure Gateway",
"versions": [
{
"version": "3.10",
"lessThan": "3.10.9",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.9",
"lessThan": "3.9.23",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.8",
"lessThan": "3.8.70",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-20T16:15:53.439838Z",
"id": "CVE-2026-76347",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.4.0",
"versionEndExcluding": "9.4.14",
"matchCriteriaId": "E180CC4C-5B8B-4D69-8535-93DCF3510119"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndExcluding": "10.0.9",
"matchCriteriaId": "0FD75354-A6EE-49F9-9B8A-31287A845CFB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.2.0",
"versionEndExcluding": "10.2.6",
"matchCriteriaId": "C8FDA841-04BC-404C-B56D-7869CBD8B56C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.4.0",
"versionEndExcluding": "10.4.2",
"matchCriteriaId": "209C1DE6-893D-424D-B103-B64A314AD8DC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.8.0",
"versionEndExcluding": "3.8.70",
"matchCriteriaId": "FC3EC4A6-9C00-49CB-92DC-97F21C4E1BC1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.9.0",
"versionEndExcluding": "3.9.23",
"matchCriteriaId": "46A65041-64F2-4459-A7CB-947129FA9BEA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.0",
"versionEndExcluding": "3.10.9",
"matchCriteriaId": "84D6A11D-4EA4-4D38-B8A1-4E0D2627B245"
}
]
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0801",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}