{"id":"CVE-2026-76295","kind":"vulnerability","aliases":["CVE-2026-76295"],"related":[],"title":"Splunk Enterprise: non-admin users can list dashboards and reports beyond filter","description":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the \"admin\" or \"power\" Splunk roles could view dashboard and report listings beyond the requested filter scope while remaining within objects that the user can access.\nThe vulnerability is possible because Splunk Secure Gateway does not neutralize special characters in values before it creates filters for dashboard and report requests.\nFor more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.","summary":"Splunk Secure Gateway does not neutralize special characters in values used to build filters for dashboard and report requests. A user without the admin or power role can see dashboard and report listings beyond the filter they asked for, though still only within objects they already have access to.","severity":"medium","cvss":4.3,"epss":0.00201,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","splunk","splunk-enterprise","splunk-secure-gateway"],"not_affected_if":["admin-only-users","no-splunk-secure-gateway"],"how_to_check":"- Check the Splunk Enterprise version with `splunk version` and compare it to the fixed releases.\n- Check the Splunk Secure Gateway app version in the Splunk apps list (Apps > Manage Apps) and compare it to the fixed releases.","fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16` depending on the release line.\n- Upgrade Splunk Secure Gateway to `3.10.12`, `3.9.26`, or `3.8.73` depending on the release line.","status":"open","published_at":"2026-10-21T23:17:27+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:37:37+00:00","updated_at":"2026-10-25T04:37:37+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:37:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16` depending on the release line.\n- Upgrade Splunk Secure Gateway to `3.10.12`, `3.9.26`, or `3.8.73` depending on the release line.","reach":"network","title":"Splunk Enterprise: non-admin users can list dashboards and reports beyond filter","impact":"low","summary":"Splunk Secure Gateway does not neutralize special characters in values used to build filters for dashboard and report requests. A user without the admin or power role can see dashboard and report listings beyond the filter they asked for, though still only within objects they already have access to.","category":"other","nicknames":[],"who_cares":["splunk","splunk-enterprise","splunk-secure-gateway","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Non-admin users see dashboard and report listings outside their requested filter scope","analyst_note":"","how_to_check":"- Check the Splunk Enterprise version with `splunk version` and compare it to the fixed releases.\n- Check the Splunk Secure Gateway app version in the Splunk apps list (Apps > Manage Apps) and compare it to the fixed releases.","needs_analyst":false,"not_affected_if":["admin-only-users","no-splunk-secure-gateway"],"who_is_affected":"Deployments running Splunk Enterprise below the listed fixed versions with Splunk Secure Gateway installed, where non-admin users have access to dashboards and reports. Exposure is limited to listing objects the user can already access, so deployments without non-admin users or without dashboards and reports have less to worry about.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":3554,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-76295':16A,19A '/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access)':169C '10.0.11':87C '10.2.8':86C '10.4.4':85C '3.10.12':96C '3.8.73':99C '3.9.26':97C '9.4.16':89C 'access':79B,131C,166C 'admin':5A,55B,107C 'alreadi':77B 'ask':69B 'base':164C 'beyond':12A,65B,118C 'build':44B 'charact':39B,144C 'configur':161C 'could':112C 'creat':149C 'cve':14A,17A 'dashboard':9A,47B,61B,114C,152C 'document':173C 'enterpris':2A,27B,82C 'filter':13A,45B,67B,121C,150C 'gateway':31B,34B,93C,139C 'help.splunk.com':168C 'help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access)':167C 'hold':105C 'host':23B 'inform':158C 'list':8A,64B,117C 'neutral':37B,142C 'non':4A 'non-admin':3A 'object':75B,126C 'possibl':135C 'power':57B,109C 'remain':124C 'report':11A,49B,63B,116C,154C 'request':50B,120C,155C 'role':58B,111C,163C 'role-bas':162C 'scope':122C 'secur':30B,33B,92C,138C 'see':60B,159C 'self':22B 'self-host':21B 'special':38B,143C 'splunk':1A,24B,26B,29B,32B,81C,91C,110C,137C,172C 'splunk-enterpris':25B 'splunk-secure-gateway':28B 'still':72B 'though':71B 'use':42B 'user':6A,52B,101C,129C,165C 'valu':41B,146C 'version':83C,94C 'view':113C 'vulner':133C 'within':74B,125C 'without':53B","nicknames":[],"mitigations":[],"who_affected":"Deployments running Splunk Enterprise below the listed fixed versions with Splunk Secure Gateway installed, where non-admin users have access to dashboards and reports. Exposure is limited to listing objects the user can already access, so deployments without non-admin users or without dashboards and reports have less to worry about.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76295","severity":null,"published_at":"2026-10-21T23:17:27+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76295","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76295","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}