CVE-2026-76405— Information Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app
Quick assessment
Affected
Splunk Splunk On-Call (VictorOps)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Splunkbase 上发布的 Splunk On-Call（VictorOps）应用 1.0.43 以下版本中，不具备 Splunk “admin”（管理员）或“power”（高级用户）角色的用户，可以从应用密钥值存储（KV Store）中读取部分脱敏的应用程序编程接口（API）密钥。由于该应用在将 API 密钥存入 KV Store 集合前未对其进行完全脱敏处理，而该集合可由普通用户读取，从而导致敏感信息泄露。有关 KV Store 的更多信息，请参阅 Splunk 文档中的“关于应用密钥值存储”（http
Possible ATT&CK Techniques 1 AI
T1552.005 · Cloud Instance Metadata APIAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Splunk | Splunk On-Call (VictorOps) | 1.0< 1.0.43 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76405
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app
Source: CVE Program / CVE List V5
Vulnerability Description
In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store). The exposure is possible because the Splunk On-Call (VictorOps) app does not fully mask the API key before storing it in a KV Store collection that the user can read. For more information see About the app key value store (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/administer-the-app-key-value-store/about-the-app-key-value-store) in the Splunk documentation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文存储
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Splunk | Splunk On-Call (VictorOps) | 1.0 ~ 1.0.43 | - |
|
II. Public POCs for CVE-2026-76405
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76405
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76405 (1)
Same Patch Batch · Splunk · 2026-08-19 · 110 CVEs total
| CVE-2026-76311 | 9.4 CRITICAL | Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterprise |
| CVE-2026-76312 | 9.4 CRITICAL | Improper Access Control through Embedded Reports in Splunk Enterprise |
| CVE-2026-76310 | 9.4 CRITICAL | Improper Access Control through Embedded Report REST API Requests in Splunk Enterprise |
| CVE-2026-76404 | 9.1 CRITICAL | Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server |
| CVE-2026-76335 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76351 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secu |
| CVE-2026-76253 | 8.8 HIGH | Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterpr |
| CVE-2026-76315 | 8.8 HIGH | Code Injection through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76352 | 8.8 HIGH | Improper Authorization through the REST API in Splunk Enterprise |
| CVE-2026-76317 | 8.8 HIGH | Path Traversal through the Lookup Configuration REST API in Splunk Enterprise |
| CVE-2026-76313 | 8.8 HIGH | Remote Code Execution (RCE) through the REST API in Splunk Enterprise |
| CVE-2026-76395 | 8.8 HIGH | Remote Code Execution (RCE) through Deserialization of Untrusted Data in the Model Loading |
| CVE-2026-76389 | 8.8 HIGH | Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for En |
| CVE-2026-76350 | 8.8 HIGH | Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk En |
| CVE-2026-76319 | 8.8 HIGH | Remote Code Execution (RCE) through Federated Search in Splunk Enterprise |
| CVE-2026-76314 | 8.8 HIGH | Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise |
| CVE-2026-76259 | 8.8 HIGH | Improper Privilege Management on the Management Port in Splunk Enterprise for Windows |
| CVE-2026-76316 | 8.8 HIGH | Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise |
| CVE-2026-76391 | 8.3 HIGH | Improper Privilege Management through Agent Run History in Splunk AI Toolkit |
| CVE-2026-76394 | 8.3 HIGH | Missing Authorization in Container and Connection Management through the REST API in Splun |
Showing top 20 of 110 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Splunk
-
CVE-2026-76403
Improper Certificate Validation through HTTP Event Collector -
CVE-2026-76404
Remote Code Execution (RCE) through Deserialization of Untru -
CVE-2026-76401
Regular Expression Denial of Service (DoS) through the REST -
CVE-2026-76402
Server-Side Request Forgery (SSRF) through the REST API in S -
CVE-2026-76400
Denial of Service (DoS) through the REST API in Splunk Conne
Same weakness: CWE-312
-
CVE-2026-59657
Apache CloudStack: Sensitive Information Disclosure via Clea -
CVE-2026-76386
Information Disclosure through Action Parameters in Zoom app -
CVE-2026-76384
Information Disclosure through Action Parameters in Splunk A -
CVE-2026-76385
Information Disclosure through Action Parameters in Venafi a -
CVE-2026-76383
Information Disclosure through Action Parameters in RSA Secu
V. Comments for CVE-2026-76405
No comments yet