CVE-2026-76347: Splunk Enterprise SSRF Vulnerability

CVE-2026-76347 Overview

CVE-2026-76347 is a Server-Side Request Forgery (SSRF) vulnerability in Splunk Enterprise and Splunk Secure Gateway. The flaw allows a low-privileged authenticated user, who does not hold the admin or power Splunk roles, to abuse report notifications and issue system-authenticated requests to internal Splunk services. Successful exploitation can alter Search Head Cluster state and cause a denial of service. The vulnerability is tracked under CWE-918 and stems from Splunk Secure Gateway failing to validate report notification path values before dispatching internal requests.

Critical Impact
Authenticated low-privilege users can pivot through Splunk Secure Gateway to reach internal services, modify Search Head Cluster state, and trigger denial of service against monitoring infrastructure.

Affected Products

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14
Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70
Search Head Cluster deployments running the affected Secure Gateway app

Discovery Timeline

2026-08-19 - CVE-2026-76347 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76347

Vulnerability Analysis

The vulnerability resides in the report notification handling logic of Splunk Secure Gateway. When a user configures a report notification, the application accepts a user-controlled path value and uses it to construct an internal request. Because Splunk Secure Gateway sends these requests with system-level authentication, the target service treats them as trusted. An authenticated user without admin or power roles can supply a crafted notification path that redirects the internal request to arbitrary Splunk endpoints. This bypasses role-based access controls that would normally block direct calls to sensitive management APIs. The impact includes unauthorized changes to Search Head Cluster state and disruption of clustered search functionality.

Root Cause

Splunk Secure Gateway does not validate report notification path values before it issues internal requests. The missing input validation, classified as CWE-918: Server-Side Request Forgery, allows attacker-controlled paths to be trusted as internal targets. See the Splunk Security Advisory SVD-2026-0801 for vendor details.

Attack Vector

An authenticated user submits a report notification with a crafted path targeting an internal Splunk endpoint. Splunk Secure Gateway forwards the request under system authentication, bypassing the caller's role restrictions. The internal service processes the request as if it originated from a trusted component, enabling state modification or resource exhaustion in the Search Head Cluster.

No verified public exploit code exists for this issue. Refer to the Splunk Security Advisory SVD-2026-0801 for technical guidance.

Detection Methods for CVE-2026-76347

Indicators of Compromise

Unexpected report notification configurations created by non-admin, non-power users
Internal HTTP requests from Splunk Secure Gateway targeting Search Head Cluster management endpoints outside normal patterns
Sudden Search Head Cluster state transitions or captain changes without corresponding administrator activity
Elevated error rates or restarts on internal Splunk services correlated with report notification activity

Detection Strategies

Audit savedsearches.conf and notification settings for unusual action.* path values referencing internal hosts or non-standard URIs
Correlate Splunk internal audit logs (_audit, _internal) with Secure Gateway request logs to identify report notifications issuing requests to cluster management paths
Flag any report notification whose path contains loopback addresses, internal service names, or cluster management endpoints

Monitoring Recommendations

Enable verbose logging on Splunk Secure Gateway and forward logs to a centralized analytics platform for retention and search
Monitor Search Head Cluster state changes and set alerts on unauthorized captain elections or member removals
Review the list of users permitted to create report notifications and reduce it where operationally feasible

How to Mitigate CVE-2026-76347

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, or 9.4.14, or later, depending on the deployed branch
Upgrade Splunk Secure Gateway to 3.10.9, 3.9.23, or 3.8.70, or later
Review and remove report notifications configured by non-admin users pending patch deployment
Restrict who can create or modify report notifications by tightening role capabilities

Patch Information

Splunk has released fixed versions addressing the SSRF in report notification handling. Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, or 9.4.14. Upgrade Splunk Secure Gateway independently to 3.10.9, 3.9.23, or 3.8.70. Full details are available in the Splunk Security Advisory SVD-2026-0801.

Workarounds

Disable the Splunk Secure Gateway app if it is not required for mobile or remote operations
Restrict the edit_search_schedule_priority and related notification capabilities to trusted administrative roles only
Apply network segmentation to limit which internal endpoints Splunk Secure Gateway can reach

bash

# Example: disable Splunk Secure Gateway app on a search head
$SPLUNK_HOME/bin/splunk disable app splunk_secure_gateway -auth admin:<password>
$SPLUNK_HOME/bin/splunk restart