Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are secrets that compromise affected Spacebridge private-key material stored in the app collection, through the Splunk Secure Gateway App Key Value Store Representational State Transfer (REST) API. The vulnerability is possible on instances upgraded from older Splunk Secure Gateway deployments when the private-key migration remains incomplete, leaving key material in a collection with an insecure default access control list.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T22:17:14.193Z",
  "pubdate": "2026-08-19T22:17:14.193Z",
  "executiveSummary": "An access control vulnerability exists in Splunk Enterprise and Splunk Secure Gateway affecting instances upgraded from older deployments. The flaw resides within the Splunk Secure Gateway App Key Value Store Representational State Transfer (REST) API.\nThe vulnerability allows a low-privileged user lacking the 'admin' or 'power' Splunk roles to read sensitive Spacebridge asymmetric private keys. These cryptographic secrets are stored within the app collection.\nThe root cause stems from an incomplete private-key migration during upgrades from older Splunk Secure Gateway deployments, which leaves the cryptographic key material residing in a collection configured with an insecure default access control list.\nSuccessful exploitation compromises the affected Spacebridge private-key material stored in the app collection. This grants unauthorized actors access to sensitive cryptographic secrets, undermining the confidentiality and integrity of secure communications managed by the Splunk Secure Gateway.\nExploitation requires network access to the Splunk instance and a local user account without administrative or power privileges, leveraging improper authorization checks inherent to the default access control list of the unmigrated app collection.",
  "technicalDetails": "The vulnerability involves improper access controls within the Splunk Secure Gateway App Key Value Store Representational State Transfer (REST) API. The vulnerable component manages application state and persistent storage via KV store collections.\nAffected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, as well as Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70.\nThe root cause is a failure in the upgrade logic when transitioning from older Splunk Secure Gateway deployments. Specifically, when the private-key migration process remains incomplete, cryptographic key material is left residing inside a Key Value Store collection that retains an insecure default access control list.\nAuthentication requirements dictate that the attacker must possess a valid Splunk user account. However, privilege requirements are low, as users who do not hold the 'admin' or 'power' Splunk roles can successfully trigger the issue.\nThe attack flow proceeds as follows: First, an attacker authenticates to the Splunk instance using credentials for a standard user lacking administrative or power privileges. Second, the attacker interacts directly with the Splunk Secure Gateway App Key Value Store Representational State Transfer (REST) API endpoint. Third, due to the insecure default access control list on the unmigrated collection, the API fails to properly enforce authorization boundaries and responds to the request. Finally, the API returns the sensitive Spacebridge asymmetric private keys to the unauthorized user.\nThe payload behavior involves the unauthorized retrieval of cryptographic key material. Post-exploitation impact includes the full compromise of Spacebridge private-key material, potentially allowing unauthorized decryption of communications, session hijacking, or further unauthorized access within the ecosystem relying on the compromised cryptographic trust anchor."
}