{"id":"CVE-2026-76272","revision":"6c082e6d2410424a8a9c565981c37768","records":[{"revision":"6c082e6d2410424a8a9c565981c37768","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-76272","aliases":[],"title":"Missing Access Control through the REST API in Splunk Secure Gateway","description":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user is authorized to request a signature. Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are also affected. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.","state":0,"publishedAt":"2026-10-07T20:46:33.402+00:00","modifiedAt":"2026-10-08T15:07:56.769+00:00","affected":[{"ecosystem":"Vendor product","name":"Splunk Enterprise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Splunk Enterprise\",\n                    \"vendor\": \"Splunk\",\n                    \"versions\": [\n                        {\n                            \"version\": \"10.4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\",\n                            \"lessThan\": \"10.4.3\"\n                        },\n                        {\n                            \"version\": \"10.2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\",\n                            \"lessThan\": \"10.2.7\"\n                        },\n                        {\n                            \"version\": \"10.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\",\n                            \"lessThan\": \"10.0.10\"\n                        },\n                        {\n                            \"version\": \"9.4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\",\n                            \"lessThan\": \"9.4.15\"\n                        }\n                    ],\n                    \"modules\": [\n                        \"REST API\"\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Splunk Secure Gateway","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Splunk Secure Gateway\",\n                    \"vendor\": \"Splunk\",\n                    \"versions\": [\n                        {\n                            \"version\": \"3.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\",\n                            \"lessThan\": \"3.10.11\"\n                        },\n                        {\n                            \"version\": \"3.9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\",\n                            \"lessThan\": \"3.9.25\"\n                        },\n                        {\n                            \"version\": \"3.8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"custom\",\n                            \"lessThan\": \"3.8.72\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://advisory.splunk.com/advisories/SVD-2026-1001"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-76272","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-76272","identifiers":["CVE-2026-76272"]},"retained":false,"historicalAffected":[]}],"coverage":[]}