Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to the Splunk Enterprise Representational State Transfer (REST) API using a system-level session token and modify the Splunk platform configuration. The user could then obtain a session token without a password and use it to access all relevant data and affect system integrity. The vulnerability is possible because Splunk Secure Gateway does not validate decoded report notification identifiers before using them to construct requests to the Splunk Enterprise REST API.

Scores

EPSS (exploitation in 30 days)

0.42% · top 64% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

• CWE-918: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. (opens in a new tab)All about CWE-918 and its CVEs

Affected products

• Splunk · Splunk Enterprise

  • affected 10.4 – < 10.4.2
  • affected 10.2 – < 10.2.6
  • affected 10.0 – < 10.0.9
  • affected 9.4 – < 9.4.14

• Splunk · Splunk Secure Gateway

  • affected 3.10 – < 3.10.9
  • affected 3.9 – < 3.9.23
  • affected 3.8 – < 3.8.70

What to do

Solution: Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.

Workaround: Turn off or remove the Splunk Secure Gateway app. See [Manage app and add-on objects](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/meet-splunk-apps/manage-app-and-add-on-objects) in the Splunk documentation. Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

References (1)

• https://advisory.splunk.com/advisories/SVD-2026-0801 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-76351](https://trackcve.app/badge/CVE-2026-76351.svg)](https://trackcve.app/cve/CVE-2026-76351)

Record last updated 21 Aug 2026, 03:56 UTC.