CVE-2026-76272 Missing Access Control through the REST API in Splunk Secure Gateway

Medium 4.3 Published 7 Oct 2026 Updated 8 Oct 2026

Unauthorized users can sign attacker-controlled payloads via the REST API, potentially leading to code execution or security bypass in Splunk Secure Gateway.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-76272?

CVE-2026-76272 is a medium-severity missing authorization vulnerability in Splunk Splunk, published on 7 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user is authorized to request a signature. Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are also affected. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Weakness: CWE-862

Which versions are affected by CVE-2026-76272?

It affects 2 products.

Products include Splunk Splunk, Splunk Splunk Secure Gateway.

How do I fix CVE-2026-76272?

No fix has been published for CVE-2026-76272 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-76272 being exploited?

There is no known exploitation of CVE-2026-76272 in the wild and no public exploit code.

All Splunk Splunk vulnerabilities

Sources

Also known as GHSA-8rx4-3877-qpv7.