Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-76274

Splunk: server-side request forgery can lead to information disclosure

Risk score
43/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
7 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer (REST) API to an attacker-controlled host and disclose the config…
Affected
Splunk
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: SplunkTHE FLAWSTHE FIXCVE-2026-76274Server-side request forgerycan lead to informationdisclosureCVSS 6.5 · EPSS 0%CVE-2026-76268Missing authenticationCVSS 9.8 · EPSS 2%CVE-2026-76284As part of Cisco's ongoingcommitment to proactivesecurity and product quality…CVSS 9.8 · EPSS 0%CVE-2026-76285As part of Cisco's ongoingcommitment to proactivesecurity and product quality…CVSS 9.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedSplunkAMBER · PATCH THIS WEEKSplunkIn Splunk Enterprise versionsbelow 10.4.3 and 10.2.7, anunauthenticated user withnetwork access to the PatroniRepresentational StateTransfer (REST) ApplicationProgramming Interface (API)…Where it standsNo known exploitationCONNECTS TOSame weaknessServer-side request forgery (CWE-918)220 other warnings in 30 days →Same productEarlier Splunk warnings18 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Splunk: Amber, patch this week. In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible bec…

The flaws

  • CVE-2026-76274: Server-side request forgery can lead to information disclosure (CVSS 6.5 · EPSS 0%)
  • CVE-2026-76268: Missing authentication (CVSS 9.8 · EPSS 2%)
  • CVE-2026-76284: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-76285: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has… (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Splunk

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer (REST) API to an attacker-controlled host and disclose the configured Observability Cloud Application Programming Interface (API) token. The vulnerability is possible because Splunk App for Splunk Observability Cloud does not fully validate the destination of an outbound request. For more information see Authentication tokens (https://help.splunk.com/en/splunk-observability-cloud/administer/authentication-and-security/authentication-tokens) in the Splunk documentation. Splunk Enterprise versions 9.4.x are not affected.

Last activity 7 Oct 2026. Patch Forecast updates every hour.