CVE-2026-76260 Overview
CVE-2026-76260 is an information disclosure vulnerability in Splunk Enterprise that allows authenticated users to read encrypted stored credentials through the Representational State Transfer (REST) API. The flaw stems from an incorrect permission assignment where the properties REST endpoint requires the rest_properties_get capability instead of the more restrictive list_storage_passwords capability. Any user with a role granting rest_properties_get can retrieve stored credentials that should be limited to privileged administrators. Splunk resolved the issue in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The weakness is tracked under [CWE-732] Incorrect Permission Assignment for Critical Resource.
Critical Impact
Authenticated users holding low-privilege roles can extract encrypted stored credentials via the REST API, exposing downstream systems and data protected by those secrets.
Affected Products
- Splunk Enterprise versions below 10.4.2
- Splunk Enterprise versions below 10.2.6 and 10.0.9
- Splunk Enterprise versions below 9.4.14
Discovery Timeline
- 2026-08-19 - CVE-2026-76260 published to NVD
- 2026-08-20 - Last updated in NVD database
- Vendor advisory - Splunk Security Advisory SVD-2026-0801
Technical Details for CVE-2026-76260
Vulnerability Analysis
Splunk Enterprise exposes a properties REST endpoint that returns configuration data, including credential material stored by the platform. The endpoint enforces authorization using the rest_properties_get capability rather than the credential-specific list_storage_passwords capability. This mismatch grants credential read access to a broader set of roles than intended.
An authenticated attacker with any role holding rest_properties_get can issue REST requests to enumerate and read encrypted stored credentials. Splunk uses these credentials to authenticate to external data sources, apps, and integrations. Exposure of these secrets can lead to lateral movement into connected systems and access to data protected by those credentials.
Root Cause
The root cause is a permission model misalignment classified as [CWE-732]. The properties endpoint should require list_storage_passwords to gate access to credential-bearing configuration keys but instead relies on the general-purpose rest_properties_get capability. Roles designed for read-only property inspection therefore inherit credential read access.
Attack Vector
Exploitation requires network access to the Splunk management interface and valid authentication with a role that includes rest_properties_get. No user interaction is needed. The attacker queries the REST properties endpoint targeting configuration stanzas that contain stored credentials, then decodes the returned material for use against external systems referenced by those credentials.
No public proof-of-concept exploit is available at the time of publication, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Splunk Security Advisory SVD-2026-0801 for full vendor guidance.
Detection Methods for CVE-2026-76260
Indicators of Compromise
- Unexpected authenticated requests to the Splunk /services/properties/ REST endpoint from non-administrative user contexts.
- Audit log entries in _audit index showing REST access to configuration stanzas that contain credential fields by users not assigned the admin or sc_admin roles.
- Bursts of REST queries enumerating multiple property namespaces from a single session token.
Detection Strategies
- Review the Splunk _audit index for action=rest events targeting properties endpoints and correlate with the invoking user's assigned capabilities.
- Baseline normal REST API usage per role and alert on deviations, particularly credential-adjacent configuration reads by non-admin roles.
- Hunt for the use of the rest_properties_get capability outside the roles that legitimately require it.
Monitoring Recommendations
- Forward Splunk internal audit logs to a centralized analytics platform and retain them for behavioral analysis.
- Alert on any downstream authentication failures or anomalous logins to systems whose credentials are stored in Splunk, which may indicate credential reuse after theft.
- Track role and capability assignments over time to identify grants of rest_properties_get to unexpected roles.
How to Mitigate CVE-2026-76260
Immediate Actions Required
- Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later, matching your maintenance branch.
- Audit all roles that hold the rest_properties_get capability and remove it from any role that does not strictly require it.
- Rotate stored credentials that may have been exposed to accounts holding rest_properties_get prior to patching.
Patch Information
Splunk has released fixed builds in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The patched releases realign the properties endpoint authorization to require the list_storage_passwords capability when returning credential material. Refer to Splunk Security Advisory SVD-2026-0801 for the complete list of fixed builds and download locations.
Workarounds
- Restrict the rest_properties_get capability to administrative roles only until the upgrade is complete.
- Limit network access to the Splunk management port (default 8089) to trusted administrative networks.
- Rotate any stored credentials configured in Splunk after upgrading to invalidate secrets that may have been read prior to patching.
# Review roles that currently hold rest_properties_get
# Run against a Splunk search head as an administrator
| rest /services/authorization/roles
| search capabilities="rest_properties_get"
| table title capabilities imported_capabilities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
