CVE-2026-76351

CVE-2026-76351 represents a fundamental failure in how Splunk Secure Gateway manages the privilege boundary between untrusted user input and system-level token usage. The vulnerability isn't merely a missing validation check — it's a consequence of SSG being designed to blindly trust decoded data when constructing privileged API calls. Specifically, report notification identifiers are decoded and then used directly in REST API request construction without any validation step, allowing an attacker to manipulate the constructed requests. The root mental shortcut here is one of the most persistent in security: the belief that transformation equals sanitization. Decoding a notification identifier doesn't make it safe — it makes it ready for injection into a privileged context. SSG executes these constructed requests using a system-level session token, which means the role-based access control model that should prevent low-privilege users from modifying platform configuration is completely bypassed. The privilege escalation from 'can submit notifications' to 'can obtain unauthenticated session tokens' collapses multiple security layers simultaneously. What makes this particularly dangerous is the amplitude of the impact. This isn't surgical privilege escalation — it's a skeleton key. A user who can submit notifications can obtain a session token without authentication and access all relevant data. The secondary blast radius extends to whatever mobile device fleet SSG manages through its gateway function, since the compromise potentially reaches beyond Splunk data into managed devices. The architectural reality is likely worse than a simple oversight. SSG almost certainly needed system-level token scope to function — the notification feature required broad privileges to operate, and nobody revisited whether that access level remained appropriate as the feature aged. The vulnerability persisted because forgotten code retained high-privilege access, and the threat model for SSG almost certainly didn't account for a low-privilege user as a threat source to this notification path. Check whether other SSG components similarly decode external data and construct privileged API calls without intermediate validation — this may be a pattern rather than an isolated oversight. Examine your Splunk deployment for SSG versions handling mobile device gateway functions, and verify whether the notification pipeline is actively maintained or has become a high-privilege attack surface through neglect.

Reviewed through automated stages and approved by a human before publication.