CVE-2026-76295
Description
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the "admin" or "power" Splunk roles could view dashboard and report listings beyond the requested filter scope while remaining within objects that the user can access. The vulnerability is possible because Splunk Secure Gateway does not neutralize special characters in values before it creates filters for dashboard and report requests. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
How to fix
- splunk splunk9.4.16, 10.0.11, 10.2.8, 10.4.4 or later
- splunk splunk_secure_gateway3.8.73, 3.9.26, 3.10.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| splunk splunk | 9.4.0 ≤ v < 9.4.16, 10.0.0 ≤ v < 10.0.11, 10.2.0 ≤ v < 10.2.8, 10.4.0 ≤ v < 10.4.4 | 9.4.16, 10.0.11, 10.2.8, 10.4.4 |
| splunk splunk_secure_gateway | 3.8.0 ≤ v < 3.8.73, 3.9.0 ≤ v < 3.9.26, 3.10.0 ≤ v < 3.10.12 | 3.8.73, 3.9.26, 3.10.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.