EUVD-2026-63113
GHSA-58cf-vcvf-5vh5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable REST API, but AC:H reflects the required incomplete-migration precondition; PR:L for any authenticated non-admin user; C:H for full private key exposure with no integrity or availability impact.
Primary rating from Vendor (cisco).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionNVD
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected Spacebridge private-key material stored in the app collection, through the Splunk Secure Gateway App Key Value Store Representational State Transfer (REST) API. The vulnerability is possible on instances upgraded from older Splunk Secure Gateway deployments when the private-key migration remains incomplete, leaving key material in a collection with an insecure default access control list.
AnalysisAI
Insufficient access controls on the Splunk Secure Gateway App Key Value Store REST API expose Spacebridge asymmetric private keys to any authenticated low-privilege user lacking the 'admin' or 'power' role. The exposure is conditional on instances that were upgraded from older Splunk Secure Gateway deployments where a private-key migration remained incomplete, leaving sensitive cryptographic material in a KVStore collection governed by an insecure default ACL. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid Splunk user account that does NOT hold the 'admin' or 'power' role - any lower-privileged authenticated user qualifies; (2) the target Splunk instance must have been previously upgraded from an older Splunk Secure Gateway deployment; and (3) the Spacebridge private-key migration must have remained incomplete after that upgrade, leaving key material in the original KVStore collection with an insecure default ACL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 5.3 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects the key risk trade-offs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with any valid low-privilege Splunk account - such as a read-only analyst account or a service account - queries the Splunk Secure Gateway KVStore REST API endpoint targeting the collection storing Spacebridge private keys on an instance that underwent an incomplete key migration. The API returns the private key material due to the permissive default ACL, enabling the attacker to impersonate the Spacebridge server or decrypt communications between Splunk mobile clients and the Spacebridge backend. … |
| Remediation | Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 (or later within the respective branches) and upgrade Splunk Secure Gateway to version 3.10.9, 3.9.23, or 3.8.70 (or later), as documented in the Splunk advisory SVD-2026-0801 at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today