CVE-2026-76251

CVE-2026-76251 is a capability enforcement bypass in the Splunk App for Splunk Observability Cloud that allows low-privilege users to trigger the app's inter-system forwarding path using a stored high-privilege access token. The vulnerability affects Splunk 10.0.x before 10.0.9, 10.1.x before 10.2.6, and 10.2.x before 10.4.2. Splunk 9.x versions are unaffected — this version asymmetry is analytically significant because it indicates a regression rather than a long-standing oversight, suggesting architectural changes in the 10.x release lineage removed or broke the `read_o11y_content` capability check at the forwarding boundary. The core issue is that the app acts as a proxy, forwarding requests to Splunk Observability Cloud using stored credentials with elevated privileges. When low-privilege users can invoke this forwarding path, they inherit the token's authority without any local authorization gate. This is an authorization bypass that weaponizes the trust Splunk itself established with the downstream service — the capability system governs local authorization decisions, not interposition layers that borrow high-privilege tokens on behalf of callers. The CVSS 7.1 score warrants scrutiny. The base metric captures technical scope, but the operational consequences of token misuse extend far beyond what the score reflects. Splunk Observability Cloud hosts alerting rules, on-call routing, and incident notifications. A low-privilege user who modifies these configurations doesn't just read telemetry — they can suppress alerts for their own activity, redirect incident notifications, or introduce noise that degrades the organization's ability to detect compromise. The CVE description's phrasing of 'limited changes' is critically ambiguous: it could mean changing notification preferences, or it could mean rewriting alert thresholds for any service in the environment. This ambiguity itself is significant because defenders cannot properly scope risk or prioritise remediation without knowing the token's actual write scope. The EPSS score of 0.00211 likely underweights this vulnerability. Inter-system forwarding vulns with stored credentials have a characteristic exploitation arc: they remain quiet until disclosure, then spike because the CVE itself becomes the exploit roadmap. The temporal gap between patch availability and active exploitation compresses violently post-disclosure for this vulnerability class. Treating the CVSS 7.1 as a definitive risk assessment and deprioritising based on EPSS alone creates a dangerous exposure window. Prioritise patching for any Splunk 10.x deployment running the Observability Cloud app, regardless of whether the install base is internal-only. The inter-system forwarding path represents a lateral movement vector with downstream access to alerting and incident-response infrastructure. If immediate patching isn't feasible, restrict which users can invoke the app's forwarding endpoints and audit for unusual patterns in Splunk Observability Cloud configuration changes — alert suppression, notification routing modifications, or dashboard alterations that coincide with low-privilege user activity.

Reviewed through automated stages and approved by a human before publication.