CVE-2026-76257

This vulnerability exposes a fundamental flaw in how Splunk guards the cryptographic keys that underpin mobile device enrollment trust. The 'list storage passwords' capability—a permission designed for admin recovery scenarios—was never audited against what happens when those stored secrets are consumed by Splunk Secure Gateway endpoints. An attacker with this relatively low-privilege permission can reach SSG REST handlers that process MDM signing secrets without triggering SSG-specific admin privilege checks. This isn't a credential disclosure vulnerability in the traditional sense; the MDM signing keys are asymmetric key material used to authenticate the enrollment handshake between devices and your MDM infrastructure. With these keys, an attacker could potentially forge enrollment tokens, issue malicious device certificates, or impersonate the MDM server to enrolled devices. The blast radius extends well beyond the technical CVSS 6.5 rating. Compromised keys persist in the trust chain until devices are re-enrolled—a process that for organizations with thousands of devices takes weeks, not days. The remediation itself creates a temporary exposure window: between patch deployment and complete re-enrollment, your MDM trust foundation remains weakened while attackers observe your re-enrollment traffic patterns. Treat this not as a user-level breach requiring credential rotation, but as a trust chain failure requiring coordinated device re-enrollment. The root cause is that SSG REST endpoints don't perform privilege validation before processing requests that consume stored secrets. This suggests other SSG endpoints may exhibit similar patterns—audit your SSG API surface comprehensively, not just the three endpoint categories now patched. More critically, examine whether other Splunk modules consume stored credentials without module-specific enforcement. The permission model conflates credential listing (recovery-focused) with credential usage in security-critical flows (enrollment trust establishment)—a capability inflation that remained invisible because no provenance tracking exists to map which credentials feed which downstream modules. After patching, verify that Splunk's audit logging captures when stored passwords are accessed through SSG API paths—this permission may have provided false assurance by appearing controlled while leaving no forensic trail of actual consumption.

Reviewed through automated stages and approved by a human before publication.