CVE-2026-76405 Overview
CVE-2026-76405 affects the Splunk On-Call (VictorOps) app on Splunkbase in versions below 1.0.43. The app stores an Application Programming Interface (API) key in an App Key Value Store (KV Store) collection without full masking. A low-privileged Splunk user who does not hold the admin or power role can read the partially masked key from the collection. The weakness maps to Cleartext Storage of Sensitive Information [CWE-312] and enables information disclosure to authenticated users. Splunk addressed the issue in version 1.0.43 of the app.
Critical Impact
Authenticated Splunk users without elevated roles can retrieve a partially masked API key from the KV Store, exposing credential material that could be leveraged against the VictorOps integration.
Affected Products
- Splunk On-Call (VictorOps) app on Splunkbase, versions below 1.0.43
- Splunk deployments (Enterprise or Cloud) with the vulnerable app installed
- Environments where non-admin, non-power Splunk users have KV Store read access
Discovery Timeline
- 2026-08-19 - CVE-2026-76405 published to the National Vulnerability Database (NVD)
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76405
Vulnerability Analysis
The Splunk On-Call (VictorOps) app persists an API key inside a KV Store collection. The app fails to fully mask the key value before writing it, leaving credential material accessible to users who can read the collection. Splunk's KV Store is a per-app document store that inherits access controls from the app's configuration. Any authenticated user with read access to that collection can query the partially masked value.
The scope of the exposure is limited to confidentiality. The vulnerability does not permit modification of stored data or disruption of app availability. However, the leaked key can be reused against the VictorOps API depending on how much of the secret is exposed and how the receiving service validates requests.
Root Cause
The root cause is Cleartext Storage of Sensitive Information [CWE-312]. The app writes the API key to a KV Store collection without applying the masking that Splunk provides for secrets stored in passwords.conf through the storage/passwords endpoint. Storing credentials in a KV Store collection bypasses Splunk's secret storage abstractions and exposes the value to any role that can read the collection.
Attack Vector
An attacker requires an authenticated Splunk account without admin or power roles. The attacker queries the KV Store collection owned by the Splunk On-Call (VictorOps) app using standard REST endpoints such as /servicesNS/-/<app>/storage/collections/data/<collection>. The response returns the partially masked API key. No user interaction beyond authenticated API access is required. Refer to the Splunk Security Advisory SVD-2026-0808 for vendor technical details.
Detection Methods for CVE-2026-76405
Indicators of Compromise
- Unexpected authenticated requests from low-privileged users to /servicesNS/-/*/storage/collections/data/* targeting the Splunk On-Call (VictorOps) app
- Splunk audit log entries showing KV Store read operations against the VictorOps app collections by non-admin, non-power users
- Unusual VictorOps API activity originating from IP addresses not associated with the sanctioned Splunk integration
Detection Strategies
- Audit installed Splunk app versions and flag Splunk On-Call (VictorOps) installations below 1.0.43
- Review Splunk _audit index for KV Store collections/data reads correlated with the VictorOps app namespace
- Correlate Splunk user role assignments with users that have historically accessed the VictorOps app collections
Monitoring Recommendations
- Enable Splunk audit logging for REST endpoint access and forward events to a central data lake for retention
- Monitor the VictorOps side for API calls that do not match known Splunk integration source addresses or expected call patterns
- Alert on new or modified Splunk roles that grant read access to app KV Store collections containing credential material
How to Mitigate CVE-2026-76405
Immediate Actions Required
- Upgrade the Splunk On-Call (VictorOps) app on Splunkbase to version 1.0.43 or later
- Rotate the VictorOps API key used by the integration after upgrading to invalidate any previously exposed value
- Review current Splunk role assignments and remove KV Store read access from users who do not require it
Patch Information
Splunk released version 1.0.43 of the Splunk On-Call (VictorOps) app on Splunkbase to remediate this issue. Consult the Splunk Security Advisory SVD-2026-0808 for authoritative fix and version information.
Workarounds
- Restrict the Splunk On-Call (VictorOps) app to users holding the admin or power roles until the upgrade is applied
- Disable or remove the app in environments where the VictorOps integration is not actively used
- Restrict network egress from Splunk to the VictorOps API to sanctioned source addresses only
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
