Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "sc_admin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in App Key Value Store (KV Store) collections that later alert and subscription workflows use. The vulnerability is possible because the affected collections allow unrestricted write access instead of limiting writes to authorized Splunk Secure Gateway workflows. For more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/administer-the-app-key-value-store/about-the-app-key-value-store), KV store endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/10.4/kv-store-endpoints/kv-store-endpoint-descriptions), and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
CVE-2026-76280
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-76280
Splunk Enterprise
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Splunk Secure Gateway
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Splunk",
"modules": [
"REST API"
],
"product": "Splunk Enterprise",
"versions": [
{
"status": "affected",
"version": "10.4",
"lessThan": "10.4.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.2",
"lessThan": "10.2.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.0",
"lessThan": "10.0.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.4",
"lessThan": "9.4.15",
"versionType": "custom"
}
]
},
{
"vendor": "Splunk",
"product": "Splunk Secure Gateway",
"versions": [
{
"status": "affected",
"version": "3.10",
"lessThan": "3.10.11",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.9",
"lessThan": "3.9.25",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.8",
"lessThan": "3.8.72",
"versionType": "custom"
}
]
}
]- Related CVEs
- CVE-2026-76280
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #16377 · Revision 1
- Added to Heist Feed
- Publisher date