---
id: "CVE-2026-76295"
kind: "vulnerability"
aliases: ["CVE-2026-76295"]
title: "Splunk Enterprise: non-admin users can list dashboards and reports beyond filter"
severity: "medium"
cvss: 4.3
epss: 0.00201
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "splunk", "splunk-enterprise", "splunk-secure-gateway"]
not_affected_if: ["admin-only-users", "no-splunk-secure-gateway"]
published_at: "2026-10-21T23:17:27+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:37:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76295", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76295", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk Enterprise: non-admin users can list dashboards and reports beyond filter

Splunk Secure Gateway does not neutralize special characters in values used to build filters for dashboard and report requests. A user without the admin or power role can see dashboard and report listings beyond the filter they asked for, though still only within objects they already have access to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Splunk Enterprise version with `splunk version` and compare it to the fixed releases.
- Check the Splunk Secure Gateway app version in the Splunk apps list (Apps > Manage Apps) and compare it to the fixed releases.

## Fix

- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16` depending on the release line.
- Upgrade Splunk Secure Gateway to `3.10.12`, `3.9.26`, or `3.8.73` depending on the release line.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76295
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76295

## From the sources

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the "admin" or "power" Splunk roles could view dashboard and report listings beyond the requested filter scope while remaining within objects that the user can access.
The vulnerability is possible because Splunk Secure Gateway does not neutralize special characters in values before it creates filters for dashboard and report requests.
For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_