CVE-2026-76351: Splunk Enterprise Auth Bypass Vulnerability

CVE-2026-76351 Overview

CVE-2026-76351 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Splunk Enterprise and Splunk Secure Gateway. A low-privileged authenticated user, without the admin or power Splunk roles, can send crafted report notification data that causes Splunk Secure Gateway to issue requests to the Splunk Enterprise Representational State Transfer (REST) API using a system-level session token. The attacker can then modify platform configuration, obtain a session token without a password, and access sensitive data.

Critical Impact
A low-privileged user can escalate to full platform access by coercing Splunk Secure Gateway into making authenticated REST API calls with a system session token, resulting in configuration tampering and data exposure.

Affected Products

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14
Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70
Splunk deployments where Secure Gateway processes report notifications

Discovery Timeline

2026-08-19 - CVE-2026-76351 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76351

Vulnerability Analysis

The vulnerability stems from Splunk Secure Gateway failing to validate decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API. Because Secure Gateway performs those outbound requests with a system-level session token, any request the attacker can influence executes with elevated privileges.

An attacker who submits crafted notification data can redirect Secure Gateway to arbitrary REST endpoints on the local Splunk instance. This allows the attacker to modify configuration, create or extract session tokens, and pivot to full access to indexed data. The flaw compromises confidentiality, integrity, and availability of the Splunk platform.

Root Cause

The root cause is missing input validation in the Splunk Secure Gateway component that decodes report notification identifiers. Secure Gateway trusts the decoded identifier and uses it directly when constructing the target URL for a privileged REST API call, satisfying the classic SSRF pattern described in [CWE-918].

Attack Vector

Exploitation requires network access to Splunk and a valid low-privileged account that does not hold the admin or power role. The attacker submits crafted report notification data through the Splunk Secure Gateway workflow. Secure Gateway decodes the identifier and issues an authenticated REST API request as a system-level principal, letting the attacker read privileged endpoints, alter platform configuration, and mint a session token without needing a password.

For technical specifics, see the Splunk Security Advisory SVD-2026-0801.

Detection Methods for CVE-2026-76351

Indicators of Compromise

Unexpected REST API calls originating from the Splunk Secure Gateway component to internal endpoints such as /services/authentication/httpauth-tokens or /services/authentication/users.
Creation or use of session tokens that lack a corresponding password authentication event in the audit log.
Configuration changes in authorize.conf, authentication.conf, or server.conf performed by system-level principals following Secure Gateway activity.
Report notification submissions from accounts without the admin or power role that trigger downstream REST API traffic.

Detection Strategies

Correlate Splunk audit logs (index=_audit) with Secure Gateway request logs to identify low-privileged users whose actions produce system-token REST API calls.
Alert on report notification identifiers containing unexpected characters, path separators, or URL fragments after decoding.
Baseline normal Secure Gateway REST call patterns and flag deviations to sensitive administrative endpoints.

Monitoring Recommendations

Enable and forward _audit and _internal indexes to a centralized analytics platform for cross-correlation.
Monitor session token issuance events and match them against authentication events to detect tokens issued without a login.
Review Splunk Secure Gateway logs for identifier decoding errors or anomalous target URLs.

How to Mitigate CVE-2026-76351

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later as applicable to your deployment branch.
Upgrade Splunk Secure Gateway to 3.10.9, 3.9.23, 3.8.70, or later.
Audit user roles and remove unnecessary accounts that can submit report notifications.
Rotate session tokens and administrative credentials if suspicious Secure Gateway activity is observed.

Patch Information

Splunk has released fixed versions addressing the missing validation in Secure Gateway. Refer to Splunk Security Advisory SVD-2026-0801 for full remediation guidance and version mapping.

Workarounds

Disable or uninstall the Splunk Secure Gateway app if it is not required in your deployment.
Restrict which roles are permitted to create or schedule report notifications through capability assignments.
Place network controls in front of the Splunk management port (8089) to limit which sources can reach the REST API.

bash

# Disable the Splunk Secure Gateway app until patching is complete
/opt/splunk/bin/splunk disable app splunk_secure_gateway -auth admin:<password>
/opt/splunk/bin/splunk restart