Skip to content
VulniPulse
Medium5.4Splunk

Medium [CVE-2026-76347] Server-Side Request Forgery (SSRF) through the Report Notifications REST API in Splunk Secure Gateway

This medium-severity Splunk advisory covers CVE-2026-76347 affecting Splunk Enterprise, Splunk Secure Gateway.

CVE-2026-76347 Published Aug 19, 2026Updated by vendor Aug 19, 2026
Affected products & platforms
SplunkSplunk Enterprise
Open vendor advisory

Android app · Google Play

Monitor future Splunk CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Summary

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery (SSRF) in report notifications to send system-authenticated requests to internal Splunk services, which could allow for changes to Search Head Cluster state and a denial of service.

The vulnerability is possible because Splunk Secure Gateway does not validate report notification path values before it sends internal requests.

Affected versions
  • Splunk Enterprise 10.4 before 10.4.2
  • Splunk Enterprise 10.2 before 10.2.6
  • Splunk Enterprise 10.0 before 10.0.9
  • Splunk Enterprise 9.4 before 9.4.14
  • Splunk Secure Gateway 3.10 before 3.10.9
  • Splunk Secure Gateway 3.9 before 3.9.23
  • Splunk Secure Gateway 3.8 before 3.8.70

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Fixed versions
  • 10.4.2
  • 10.2.6
  • 10.0.9
  • 9.4.14
  • 3.10.9
  • 3.9.23
  • 3.8.70

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Mitigation

Upgrade to a fixed release: 10.4.2, 10.2.6, 10.0.9, 9.4.14, 3.10.9, 3.9.23. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.