Splunk Enterprise CVE-2026-76295

Requires a valid authenticated Splunk account that does NOT hold the admin or power roles (PR:L), and exploitation goes through the Splunk Secure Gateway feature (the mobile/remote access gateway shipped with Splunk Enterprise), which must be in use for dashboard and report requests. The attacker injects special characters into filter values because Splunk Secure Gateway fails to neutralize them before building dashboard/report filters. Limiting factor: the disclosure is confined to dashboard and report LISTINGS within objects the user is already permitted to access, so it only widens filter scope rather than granting access to otherwise-forbidden objects; deployments not using Secure Gateway, or already on the fixed versions, are not exposed.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 Medium) describes a low-privileged but authenticated attacker (PR:L) with low attack complexity and no user interaction, yielding only a limited confidentiality impact (C:L) and no integrity or availability impact. Crucially, the description constrains the leak further: the user can view dashboard and report LISTINGS beyond the requested filter scope but still only within objects the user is already authorized to access, so this is a filter-scope/enumeration weakness rather than a true cross-tenant or privilege-escalation access-control bypass. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no signal of active or probable exploitation and no public exploit identified at time of analysis. The SSVC framework is not supplied. Net assessment: a real but minor information-disclosure bug suitable for routine patching cycles, not emergency remediation; the broad real-world footprint of Splunk is the main reason to patch promptly rather than any exploitation pressure.

An authenticated Splunk user who lacks the admin or power roles crafts a dashboard or report listing request through Splunk Secure Gateway, embedding special characters in the filter values so the server-side filter is manipulated (NoSQL-style injection, CWE-943). This returns dashboard and report listings beyond the intended filter scope, though still limited to objects the user can already access. No public exploit code was identified at time of analysis, and exploitation requires valid low-privilege credentials.