Splunk Enterprise CVE-2026-76274

Exploitation requires an authenticated Splunk user assigned a role that includes the read_o11y_content capability, and the environment must have the Splunk App for Splunk Observability Cloud installed and configured with an Observability Cloud API token. The attacker triggers the flaw through the REST API by directing an outbound request to an attacker-controlled host, which succeeds because the app does not fully validate the outbound destination. Limiting factors: the specific read_o11y_content capability is a meaningful privilege gate (not every user holds it), the vulnerable Observability Cloud app must be present and token-configured, and Splunk Enterprise 9.4.x is explicitly not affected. No end-user interaction is needed.

This is a medium-severity SSRF (CWE-918) with a vendor-provided CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and my independent assessment agrees with that vector. The network vector and low attack complexity make the technical trigger easy, but PR:L is the decisive limiting factor: the attacker must already hold a Splunk role granting the read_o11y_content capability, so this is a privileged-insider / post-authentication issue rather than an internet-facing unauthenticated one. Impact is confidentiality-only (C:H, I:N, A:N) - the specific prize is the configured Observability Cloud API token, not code execution or data destruction. On the exploitation-likelihood side the signals are consistently low: there is no CISA KEV listing, no public exploit code, and no EPSS score was supplied, so no public exploit identified at time of analysis. No SSVC decision data was provided. Net assessment: a real but moderate priority - patch in normal cycles, prioritize where many users hold the read_o11y_content capability or where the leaked Observability Cloud token is highly privileged. It is not a drop-everything emergency absent evidence of exploitation. Note the required capability (read_o11y_content) is not expressible in the CVSS vector beyond PR:L, so defenders should treat PR:L as 'any user with that specific capability,' which may be broader than 'admin.'

An authenticated Splunk user who has been granted a role carrying the read_o11y_content capability uses the REST API to cause the Splunk App for Splunk Observability Cloud to send an outbound request to a host the attacker controls. Because the app does not fully validate the outbound destination, the configured Observability Cloud API token is included in or exposed by that request and captured by the attacker's server. No public proof-of-concept or active exploitation is known at time of analysis.