CVE-2026-76274

Executive Summary

CVE-2026-76274 is a server-side request forgery (SSRF, CWE-918) vulnerability in the Splunk App for Splunk Observability Cloud (Splunk Enterprise). An authenticated user holding a role with the read_o11y_content capability can redirect an outbound request—issued through the Splunk REST API—to an attacker-controlled host, causing the configured Observability Cloud API token to be disclosed to the attacker. Because the disclosed token grants API access to the Splunk Observability Cloud environment, successful exploitation results in high confidentiality impact (CVSS 6.5, C:H; AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no integrity or availability impact.

Technical Analysis

The vulnerability class is SSRF (CWE-918). The root cause, per the NVD description, is that the Splunk App for Splunk Observability Cloud "does not fully validate the destination of an outbound request." The affected component is the integration between Splunk Enterprise and the Splunk Observability Cloud REST API.

Key technical facts, derived strictly from the description:

• Attack surface: The Splunk REST API, as exposed by Splunk Enterprise.
• Precondition: The authenticated user must hold a role with the read_o11y_content capability. This is a low-privilege capability intended to allow reading Observability Cloud content, not to reconfigure outbound endpoints.
• Mechanism: The app constructs an outbound request to a destination derived from a parameter supplied through the REST API. Because the destination is not fully validated (no allow-list/deny-list enforcement, no host allow-listing, no redirect blocking), an attacker can specify a host they control. The outbound request carries the configured Observability Cloud API token in the request (e.g., as an authorization header or equivalent token-bearing field), which is then disclosed to the attacker-controlled host.
• Trust boundary crossed: The attacker moves from a low-privilege capability (read_o11y_content) to possession of a high-value API credential for the Splunk Observability Cloud tenant.

The critical security property violated is that outbound requests containing a credential must only ever be sent to a fixed, fully-qualified, allow-listed destination. The app's partial validation ("does not fully validate") permits attacker control of that destination—a classic SSRF-to-credential-exfiltration pattern. No further code-level detail (function names, parameters, endpoints) is available in the supplied data and none is inferred here.

Exploitation Scenarios

The following attack chain is constructed strictly from the NVD description. No public PoC is available; the chain is inferred from the SSRF vulnerability class.

1. Reconnaissance / target identification. The attacker identifies a Splunk Enterprise deployment running the Splunk App for Splunk Observability Cloud, on a version below 10.4.3, 10.2.7, or 10.0.10 (Splunk Enterprise 9.4.x is explicitly not affected). Internet-exposed Splunk management interfaces (commonly TCP 8000/8089) are candidate targets; internal deployments reachable after initial access are equally valid.

2. Prerequisite access. The attacker obtains authenticated access with a role carrying the read_o11y_content capability. This capability is normally the lowest tier of Observability Cloud–related access and is often granted to monitoring or NOC personnel, making it a realistic target for credential theft, session hijacking, or lateral movement.

3. Triggering the flaw (SSRF). The attacker issues a request through the Splunk REST API that influences the destination of an outbound request made by the Splunk App for Splunk Observability Cloud. Because the app does not fully validate the destination, the attacker supplies a destination pointing to a host they control (their own listener/collector).

4. Credential disclosure. The app performs the outbound request to the attacker-controlled host, including the configured Observability Cloud API token. The token is thereby disclosed to the attacker. The attacker captures it from their listener.

5. Post-exploitation impact. With the captured API token, the attacker can authenticate to the Splunk Observability Cloud API in the context of the victim's tenant. Depending on the token's scope (see the Splunk "Authentication tokens" documentation referenced by NVD), this may permit reading telemetry, dashboards, or other Observability Cloud content. The CVSS vector confirms high confidentiality impact (C:H), with no integrity or availability impact (I:N/A:N), consistent with a read-oriented token disclosure.

No public exploit exists (POC_STATUS: None; no Nuclei template; no exploit code). EPSS is 0.00267 (~17.3rd percentile), indicating low near-term exploitation likelihood based on current telemetry; the CVE is not in CISA KEV.

Impact Assessment

Confidentiality: High (C:H). A configured Observability Cloud API token is disclosed to an attacker-controlled host. Such tokens can expose the victim's observability data and, depending on scope, broader tenant content.

Integrity: None (I:N). The description does not indicate modification of data.

Availability: None (A:N). No denial-of-service component is described.

Attack Vector: Network (AV:N). Reachable via the Splunk REST API. Complexity: Low (AC:L). Privileges Required: Low (PR:L) — requires an authenticated role with read_o11y_content. User Interaction: None (UI:N). Scope: Unchanged (S:U). Base Score: 6.5 (Medium).

Blast radius: Any Splunk Enterprise deployment that runs the Splunk App for Splunk Observability Cloud on an affected version (below 10.4.3, 10.2.7, or 10.0.10). Version 9.4.x is not affected. The blast radius extends beyond Splunk itself: the leaked API token grants access to the organization's Splunk Observability Cloud tenant, meaning observability/telemetry data (and whatever else the token scope allows) is exposed even though the Splunk on-premises deployment itself is not directly modified. Organizations should treat a leaked token as a cross-platform credential-compromise event.

Business context: Because the vulnerable precondition is a low-privilege, read-oriented capability, insider and post-compromise threat scenarios are more plausible than unauthenticated mass exploitation. The primary risk is credential theft enabling reconnaissance into production telemetry and potentially broader tenant access.

Detection Guidance

Sigma Rule

title: Potential SSRF and API Token Disclosure via Splunk Observability Cloud App REST API
id: 8f2c1a44-7627-4c0e-9b3a-1e0f76274001
status: experimental
description: Detects REST API requests that may redirect outbound requests from the Splunk App for Splunk Observability Cloud to an attacker-controlled host (CVE-2026-76274).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76274
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: splunk
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/services/'
  selection_o11y:
    cs-uri-query|contains:
      - 'o11y'
      - 'observability'
  selection_external_host:
    cs-uri-query|contains:
      - 'http://'
      - 'https://'
  condition: selection_endpoint and (selection_o11y or selection_external_host)
falsepositives:
  - Legitimate administrative configuration of Observability Cloud integration endpoints
level: medium
tags:
  - attack.t1552.001
  - attack.t1190
  - cve.2026.76274

YARA Rule

rule CVE_2026_76274_Splunk_O11y_SSRF_Token_Exfil
{
    meta:
        description = "Detects indicators of SSRF token exfiltration against Splunk App for Splunk Observability Cloud (CVE-2026-76274)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76274"
        date = "2026-01-01"
        cve = "CVE-2026-76274"
    strings:
        $cap = "read_o11y_content" ascii nocase
        $app = "Splunk App for Splunk Observability Cloud" ascii nocase
        $o11y = "Observability Cloud" ascii nocase
        $token = "api" ascii nocase
        $tok2 = "token" ascii nocase
        $url_a = "http://" ascii
        $url_b = "https://" ascii
    condition:
        ($cap or $app or $o11y) and ($tok or $tok2) and ($url_a or $url_b)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76274 Splunk Observability Cloud App SSRF Potential Token Disclosure"; flow:established,to_server; http.uri; content:"/services/"; nocase; http.uri; content:"o11y"; nocase; http.uri; content:"http"; nocase; reference:cve,2026-76274; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76274; classtype:attempted-recon; sid:202676274; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=1m
  [http where http.request.method == "POST" and
      stringContains(http.request.uri.path, "/services/") and
      stringContains(http.request.uri.query, "o11y")]
  [network where destination.ip != null and
      stringContains(process.command_line, "Observability")]

Splunk SPL Query

index=_internal OR index=splunkd OR index=web
sourcetype IN ("splunkd_web_access","splunk_web_access","splunkd")
(cs_uri_stem="*/services/*" OR uri_path="*/services/*")
(o11y OR observability OR "Observability Cloud")
("http://" OR "https://")
| stats count min(_time) as first_seen max(_time) as last_seen
    values(user) as users values(clientip) as src_ips
    by uri_path cs_uri_query host
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="splunk,cve-2026-76274,">
  <rule id="2026740" level="10">
    <decoded_as>json</decoded_as>
    <field name="uri_path">/services/</field>
    <field name="uri_query">o11y</field>
    <field name="uri_query">http</field>
    <description>CVE-2026-76274: Potential SSRF / Observability Cloud API token disclosure attempt via Splunk REST API</description>
    <mitre>
      <id>T1552.001</id>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_76274,credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor documentation referenced by NVD indicates Splunk Enterprise versions 10.4.3, 10.2.7, and 10.0.10 address the issue, but no confirmed patch reference was returned by the tracked sources; treat patching status as unverified and confirm against the vendor advisory.

1. Immediate mitigations:

   • Restrict and audit the read_o11y_content capability. Grant it only to users and roles that strictly require it. Review all roles that include this capability.
   • Limit access to the Splunk REST API (management interfaces on TCP 8000/8089) to trusted networks and administrative users. Do not expose management ports to the internet.
   • Egress-filter outbound traffic from Splunk hosts. Only permit outbound connections to the known Splunk Observability Cloud endpoints; block all other destinations to prevent token exfiltration to attacker-controlled hosts.
   • Rotate the configured Observability Cloud API token immediately if any suspicious outbound requests or unauthorized access to the Observability Cloud tenant is observed.

2. Patch/upgrade steps:

   • Confirm the fixed versions with the Splunk vendor advisory for the Splunk App for Splunk Observability Cloud and Splunk Enterprise. The NVD description indicates affected versions are below 10.4.3, 10.2.7, and 10.0.10; Splunk Enterprise 9.4.x is not affected.
   • Upgrade to 10.4.3, 10.2.7, or 10.0.10 (or later) as applicable. Validate the installed app version in addition to the core Splunk Enterprise version.
   • After upgrade, re-verify that the configuration limits outbound request destinations to expected hosts.

3. Long-term hardening:

   • Enforce an allow-list model for all outbound requests originating from Splunk apps, especially those that carry credentials.
   • Adopt least-privilege role design and periodic review of high-value capabilities such as read_o11y_content.
   • Monitor for request-redirect patterns and treat any outbound request carrying an API token to a non-standard host as a credential-compromise incident.
   • Maintain token hygiene: scope Observability Cloud tokens to the minimum required permissions and rotate them on a schedule.

References

• NVD — CVE-2026-76274: https://nvd.nist.gov/vuln/detail/CVE-2026-76274
• Splunk Documentation — Authentication tokens (Splunk Observability Cloud): https://help.splunk.com/en/splunk-observability-cloud/administer/authentication-and-security/authentication-tokens
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK — T1552.001 Unsecured Credentials: Credentials In Files: https://attack.mitre.org/techniques/T1552/001/
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-76274 is NOT listed as of this report)

Threat actor campaigns / exploit-in-the-wild: No known campaigns or in-the-wild exploitation evidence available from the provided data. EPSS 0.00267 (~17.3rd percentile); no public PoC, no Nuclei template, no exploit code.