CVE-2026-76274
published 2026-10-07CVE-2026-76274: In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound…
PriorityP343medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.27%
17.9th percentile
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer (REST) API to an attacker-controlled host and disclose the configured Observability Cloud Application Programming Interface (API) token. The vulnerability is possible because Splunk App for Splunk Observability Cloud does not fully validate the destination of an outbound request. For more information see Authentication tokens (https://help.splunk.com/en/splunk-observability-cloud/administer/authentication-and-security/authentication-tokens) in the Splunk documentation.
Splunk Enterprise versions 9.4.x are not affected.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| splunk | splunk | >= 10.0.0 < 10.0.10 | 10.0.10 |
| splunk | splunk | >= 10.2.0 < 10.2.7 | 10.2.7 |
| splunk | splunk | >= 10.4.0 < 10.4.3 | 10.4.3 |
| splunk | splunk_enterprise | >= 10.0 < 10.0.10 | 10.0.10 |
| splunk | splunk_enterprise | >= 10.2 < 10.2.7 | 10.2.7 |
| splunk | splunk_enterprise | >= 10.4 < 10.4.3 | 10.4.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Splunk Enterprise up to 10.0.9/10.2.6/10.4.2 Splunk App for Splunk Observability Cloud redirect
vuldb·2026-10-07·CVSS 6.5
CVE-2026-76274 [MEDIUM] Splunk Enterprise up to 10.0.9/10.2.6/10.4.2 Splunk App for Splunk Observability Cloud redirect
A vulnerability described as problematic has been identified in Splunk Enterprise up to 10.0.9/10.2.6/10.4.2. The affected element is an unknown function of the component Splunk App for Splunk Observability Cloud. Executing a manipulation can lead to open redirect.
This vulnerability appears as CVE-2026-76274. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observabil
ghsa_unreviewed·2026-10-07
CVE-2026-76274 [MEDIUM] CWE-918 In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observabil
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer (REST) API to an attacker-controlled host and disclose the configured Observability Cloud Application Programming Interface (API) token. The vulnerability is possible because Splunk App for Splunk Observability Cloud does not fully validate the destination of an outbound request. For more information see Authentication tokens (https://help.splunk.com/en/splunk-observability-cloud/administer/authentication-and-security/authentication-tokens) in the Splunk documentation.
Splunk Enterprise versions 9.4.x are not affected.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-07
Published