CVE-2026-76257: Splunk Enterprise Auth Bypass Vulnerability

CVE-2026-76257 Overview

CVE-2026-76257 is a missing authorization vulnerability [CWE-862] in Splunk Enterprise and Splunk Secure Gateway. A low-privileged Splunk user who holds a role with permissions to list storage passwords can access Mobile Device Management (MDM) signing secrets without holding Splunk Secure Gateway administration privileges. The exposed secrets compromise the trust anchor for all mobile-device enrollment handled through Splunk Secure Gateway. The flaw exists because several Splunk Secure Gateway Representational State Transfer (REST) API endpoints, including those for deployment bundle, Security Assertion Markup Language (SAML) setup, and companion app workflows, do not enforce Splunk Secure Gateway administration privileges before processing requests.

Critical Impact
Authenticated low-privileged users can retrieve MDM signing secrets and undermine the integrity of every mobile device enrolled through Splunk Secure Gateway.

Affected Products

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14
Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71
Mobile devices enrolled via Splunk Secure Gateway MDM workflows

Discovery Timeline

2026-08-19 - CVE-2026-76257 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76257

Vulnerability Analysis

The vulnerability affects the REST API surface exposed by Splunk Secure Gateway. Multiple endpoints, including deployment bundle handlers, SAML setup routines, and companion app workflows, accept requests from any authenticated Splunk user that satisfies role-based access checks on storage passwords. These endpoints skip the administrative privilege check that Splunk Secure Gateway requires. As a result, a user with a role granting list_storage_passwords capability can invoke the endpoints and read sensitive material intended for administrators. The most impactful data exposed are the MDM signing secrets. These secrets sign enrollment payloads and establish the trust relationship between managed mobile devices and the Splunk Secure Gateway. Once an attacker holds the signing material, they can forge enrollment artifacts and impersonate the trust chain.

Root Cause

The root cause is missing authorization enforcement [CWE-862]. Splunk Secure Gateway REST handlers validate authentication but do not verify that the caller carries Splunk Secure Gateway administration privileges. Access control depends on capability grants that ordinary reporting or storage roles can also hold.

Attack Vector

An attacker requires network access to a Splunk instance and valid credentials for a low-privileged role that includes storage password listing. The attacker then issues REST API requests to the affected Splunk Secure Gateway endpoints. The endpoints return administrative material, including MDM signing secrets, without additional privilege checks.

No verified exploitation code is publicly available. See the Splunk Security Advisory SVD-2026-0801 for vendor technical details.

Detection Methods for CVE-2026-76257

Indicators of Compromise

Unexpected REST calls to Splunk Secure Gateway endpoints for deployment bundle, SAML setup, or companion app workflows from non-administrative user accounts.
Access to storage password listings by users who do not routinely perform administrative maintenance.
New or altered mobile device enrollments that do not correlate with authorized Splunk Secure Gateway administrator activity.

Detection Strategies

Audit Splunk internal logs (_audit and _internal indexes) for REST requests to Splunk Secure Gateway paths issued by users lacking the Splunk Secure Gateway admin role.
Correlate list_storage_passwords capability usage with the calling user, source IP, and endpoint accessed to surface anomalous read patterns.
Baseline normal administrative REST activity and alert on deviations by user, role, or endpoint frequency.

Monitoring Recommendations

Forward Splunk audit and REST access logs to a centralized analytics platform for retention and cross-user correlation.
Monitor MDM enrollment events for signing certificate changes, unexpected renewals, or enrollments outside change windows.
Track role assignments and capability grants for the list_storage_passwords capability across the deployment.

How to Mitigate CVE-2026-76257

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later, matching your maintenance track.
Upgrade Splunk Secure Gateway to version 3.10.10, 3.9.24, or 3.8.71 or later.
Rotate MDM signing secrets and re-enroll mobile devices if exposure is suspected.
Review role assignments and remove list_storage_passwords from roles that do not require it.

Patch Information

Splunk has released fixed versions that enforce Splunk Secure Gateway administration privileges on the affected REST endpoints. Refer to the Splunk Security Advisory SVD-2026-0801 for the complete list of fixed builds and upgrade guidance.

Workarounds

Disable or uninstall the Splunk Secure Gateway app if mobile device management functionality is not required.
Restrict the list_storage_passwords capability to administrative roles only.
Limit network access to Splunkd management ports to trusted administrative networks.

bash

# Example: list roles that hold list_storage_passwords capability
# Run on the Splunk search head as an administrator
| rest /services/authorization/roles \
  | search capabilities=list_storage_passwords \
  | table title capabilities