CVE-2026-76261: Splunk Information Disclosure Vulnerability

CVE-2026-76261 Overview

CVE-2026-76261 is an information disclosure vulnerability in Splunk Enterprise and Splunk Secure Gateway. A low-privileged authenticated user without the admin or power role can read Spacebridge asymmetric private keys through the Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API. The exposure occurs on instances upgraded from older Splunk Secure Gateway deployments where the private-key migration remains incomplete. In those cases, key material stays in an app collection with an insecure default access control list [CWE-732]. Successful exploitation compromises Spacebridge private-key material.

Critical Impact
Authenticated non-admin users can extract Spacebridge asymmetric private keys, compromising the cryptographic material that secures Splunk mobile and Spacebridge communications.

Affected Products

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14
Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70
Instances upgraded from older Splunk Secure Gateway deployments with incomplete private-key migration

Discovery Timeline

2026-08-19 - CVE-2026-76261 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76261

Vulnerability Analysis

The vulnerability resides in the Splunk Secure Gateway app, which uses the App Key Value Store to persist configuration and secret material. Spacebridge is the Splunk service that brokers communication between Splunk Enterprise and Splunk mobile clients. Its asymmetric key pair authenticates and secures that channel.

In upgraded deployments, private keys remain in a KV Store collection whose access control list defaults to a permissive configuration. Any authenticated Splunk user, including accounts without the admin or power role, can query the collection through the KV Store REST API and retrieve the private-key material.

Root Cause

The root cause is an incorrect permission assignment on a KV Store collection [CWE-732]. The private-key migration path for Splunk Secure Gateway does not consistently move keys out of the legacy collection or tighten its ACL. Sensitive secrets remain readable by roles that should not have access.

Attack Vector

Exploitation requires network access to the Splunk management REST API and valid credentials for any low-privileged role. An attacker issues authenticated GET requests to the Splunk Secure Gateway KV Store REST endpoints and enumerates the collection containing Spacebridge keys. No user interaction is required. With the extracted private key, an adversary can impersonate the Spacebridge tenant, decrypt intercepted Spacebridge traffic, or forge signed messages to connected mobile clients.

No public proof-of-concept code has been published. Refer to the Splunk Security Advisory SVD-2026-0801 for vendor technical details.

Detection Methods for CVE-2026-76261

Indicators of Compromise

Authenticated REST API requests from non-admin users to /servicesNS/nobody/splunk_secure_gateway/storage/collections/data/ endpoints referencing Spacebridge or key collections.
Anomalous read volume against Splunk Secure Gateway KV Store collections from user accounts that do not normally interact with mobile or Spacebridge features.
Splunk audit.log entries showing successful KV Store queries by roles other than admin or power.

Detection Strategies

Audit _audit index events for action=search or REST GET operations targeting splunk_secure_gateway collections and filter on user roles that lack administrative privileges.
Correlate REST API access patterns with user role assignments to identify enumeration of secret-bearing collections.
Review Splunk Secure Gateway app inventory for legacy KV Store collections retained after an upgrade.

Monitoring Recommendations

Enable and forward Splunk internal audit logs to a centralized analytics platform for continuous review.
Alert on any first-time access to Spacebridge KV Store collections from a given user account.
Baseline expected callers of the Splunk Secure Gateway REST endpoints and flag deviations.

How to Mitigate CVE-2026-76261

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later according to your maintenance branch.
Upgrade Splunk Secure Gateway to 3.10.9, 3.9.23, or 3.8.70 or later.
Rotate all Spacebridge asymmetric key material after upgrading, since keys that were readable must be considered compromised.
Review role capabilities and remove unnecessary REST API access from non-administrative users.

Patch Information

Splunk has released fixed versions addressing the ACL and migration defects. See the Splunk Security Advisory SVD-2026-0801 for the authoritative version matrix and remediation steps.

Workarounds

If patching is delayed, disable or uninstall the Splunk Secure Gateway app on instances that do not require Splunk mobile or Spacebridge functionality.
Restrict the KV Store collection ACL for Spacebridge key collections so only the admin and power roles can read entries.
Restrict network access to the Splunk management port to trusted administrative networks.

bash

# Configuration example: restrict KV Store collection access in collections.conf
# Located in $SPLUNK_HOME/etc/apps/splunk_secure_gateway/local/collections.conf
[<spacebridge_collection_name>]
replicate = false

# Located in $SPLUNK_HOME/etc/apps/splunk_secure_gateway/local/default.meta
[collections/<spacebridge_collection_name>]
access = read : [ admin ], write : [ admin ]
export = none