{"id":"CVE-2026-76292","kind":"vulnerability","aliases":["CVE-2026-76292"],"related":[],"title":"Splunk Enterprise: low-privileged users can read other users' mobile alert data","description":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the \"admin\" Splunk role or the \"sc_admin\" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints.\nThe vulnerability is possible because the affected Splunk Secure Gateway App Key Value Store collections do not enforce user-level authorization for read requests.\nFor more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-the-app-key-value-store/about-the-app-key-value-store) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.","summary":"Splunk Secure Gateway's app key value store collections skip per-user authorization on read requests. A low-privileged Splunk user can read mobile alert notification data belonging to other users through the KV Store REST endpoints.","severity":"medium","cvss":6.5,"epss":0.00264,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","splunk","splunk-enterprise","splunk-secure-gateway"],"not_affected_if":["admin-only-users","no-secure-gateway-app"],"how_to_check":"- Check the Splunk Enterprise version with `splunk version` and compare it to the fixed releases listed in the fix field.\n- Check the Splunk Secure Gateway app version in Splunk Web under Apps > Manage Apps, or in the app's `app.conf`.\n- Confirm whether the Splunk Secure Gateway app is installed and used for mobile alerts.","fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16`, matching your release line.\n- Upgrade Splunk Secure Gateway to `3.10.12`, `3.9.26`, or `3.8.73`, matching your release line.","status":"open","published_at":"2026-10-21T23:17:27+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:48:46+00:00","updated_at":"2026-10-25T03:48:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:48:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16`, matching your release line.\n- Upgrade Splunk Secure Gateway to `3.10.12`, `3.9.26`, or `3.8.73`, matching your release line.","reach":"network","title":"Splunk Enterprise: low-privileged users can read other users' mobile alert data","impact":"medium","summary":"Splunk Secure Gateway's app key value store collections skip per-user authorization on read requests. A low-privileged Splunk user can read mobile alert notification data belonging to other users through the KV Store REST endpoints.","category":"package","nicknames":[],"who_cares":["splunk","splunk-enterprise","splunk-secure-gateway","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Low-privileged users read other users' mobile alert notification data.","analyst_note":"","how_to_check":"- Check the Splunk Enterprise version with `splunk version` and compare it to the fixed releases listed in the fix field.\n- Check the Splunk Secure Gateway app version in Splunk Web under Apps > Manage Apps, or in the app's `app.conf`.\n- Confirm whether the Splunk Secure Gateway app is installed and used for mobile alerts.","needs_analyst":false,"not_affected_if":["no-secure-gateway-app","admin-only-users"],"who_is_affected":"Deployments running Splunk Enterprise with the Splunk Secure Gateway app installed, where some users hold roles below admin or sc_admin. Exposure depends on those users being able to reach the KV Store REST endpoints. Installations without Secure Gateway, or where all users are admins, have less to worry about.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":3666,"output_tokens":655,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-76292':16A,19A '/en/splunk-enterprise/administer/admin-manual/10.2/administer-the-app-key-value-store/about-the-app-key-value-store)':174C '/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access)':185C '10.0.11':78C '10.2.8':77C '10.4.4':76C '3.10.12':87C '3.8.73':90C '3.9.26':88C '9.4.16':80C 'access':182C 'admin':101C,107C 'affect':143C 'alert':12A,58B,115C 'api':135C 'app':36B,125C,147C,168C 'author':45B,158C 'base':180C 'belong':61B 'collect':40B,151C 'configur':177C 'could':112C 'cve':14A,17A 'data':13A,60B,117C 'document':189C 'endpoint':70B,136C 'enforc':154C 'enterpris':2A,27B,73C 'gateway':31B,34B,84C,110C,124C,146C 'help.splunk.com':173C,184C 'help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-the-app-key-value-store/about-the-app-key-value-store)':172C 'help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access)':183C 'hold':99C 'host':23B 'inform':164C 'key':37B,126C,148C,169C 'kv':67B,129C 'level':157C 'low':4A,51B,93C 'low-privileg':3A,50B,92C 'mobil':11A,57B,114C 'notif':59B,116C 'packag':20B 'per':43B 'per-us':42B 'possibl':140C 'privileg':5A,52B,94C 'read':8A,47B,56B,113C,160C 'represent':131C 'request':48B,161C 'rest':69B,134C 'role':103C,111C,179C 'role-bas':178C 'sc':106C 'secur':30B,33B,83C,109C,123C,145C 'see':165C 'self':22B 'self-host':21B 'skip':41B 'splunk':1A,24B,26B,29B,32B,53B,72C,82C,102C,108C,122C,144C,188C 'splunk-enterpris':25B 'splunk-secure-gateway':28B 'state':132C 'store':39B,68B,128C,130C,150C,171C 'transfer':133C 'user':6A,10A,44B,54B,64B,95C,120C,156C,181C 'user-level':155C 'valu':38B,127C,149C,170C 'version':74C,85C 'vulner':138C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Splunk Enterprise with the Splunk Secure Gateway app installed, where some users hold roles below admin or sc_admin. Exposure depends on those users being able to reach the KV Store REST endpoints. Installations without Secure Gateway, or where all users are admins, have less to worry about.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76292","severity":null,"published_at":"2026-10-21T23:17:27+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76292","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76292","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}