CVE-2026-76258

CVE-2026-76258 is a hard-coded cryptographic key in Splunk Secure Gateway's companion app registration handler. The key allows an attacker with a basic Splunk user account to register a malicious callback URL and intercept mobile user tokens. The tokens are scoped to the mobile user's own privileges, which means if an admin authenticates via the mobile gateway, their token becomes a pivot point into administrative functions. This is the vulnerability's real severity—not the token theft itself, but the lateral movement opportunity it creates when high-privilege users are among the mobile user population. The CVSS 6.5 captures the technical severity of a single exploitation event against a single deployment. It does not capture the structural property that makes this critical: the hard-coded key exists in Splunk's codebase itself, meaning it is identical across every Splunk deployment worldwide. This is not a per-instance secret that was misconfigured—it is a universal credential. Once extracted from any Splunk environment, it works against all Splunk environments simultaneously. That is a supply chain risk the CVSS score cannot express, and it is the dimension that should drive prioritization. Verify which Splunk Secure Gateway version is running and confirm the patch has been applied. Review mobile gateway logs for callback URL registrations, particularly those pointing to unexpected or external domains— Splunk may not log these by default. Examine token lifetime configuration: the attack window for token reuse depends entirely on how long tokens remain valid after exfiltration. Organizations on older version branches may have more permissive token lifetimes and weaker anomaly detection, making them simultaneously more valuable targets and less instrumented to detect exploitation. If egress filtering exists on Splunk deployments, verify whether it would block outbound connections from Splunk infrastructure to attacker-controlled callback URLs, as the attack requires Splunk's mobile gateway to reach out to the attacker rather than the victim's device reaching out.

Reviewed through automated stages and approved by a human before publication.