Vulnerability Details CVE-2026-76405
In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store). The exposure is possible because the Splunk On-Call (VictorOps) app does not fully mask the API key before storing it in a KV Store collection that the user can read. For more information see About the app key value store (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/administer-the-app-key-value-store/about-the-app-key-value-store) in the Splunk documentation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 3.5%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2026-76405
-
cpe:2.3:a:splunk:on-call:1.0.0
-
cpe:2.3:a:splunk:on-call:1.0.1
-
cpe:2.3:a:splunk:on-call:1.0.10
-
cpe:2.3:a:splunk:on-call:1.0.11
-
cpe:2.3:a:splunk:on-call:1.0.12
-
cpe:2.3:a:splunk:on-call:1.0.13
-
cpe:2.3:a:splunk:on-call:1.0.14
-
cpe:2.3:a:splunk:on-call:1.0.15
-
cpe:2.3:a:splunk:on-call:1.0.16
-
cpe:2.3:a:splunk:on-call:1.0.17
-
cpe:2.3:a:splunk:on-call:1.0.18
-
cpe:2.3:a:splunk:on-call:1.0.2
-
cpe:2.3:a:splunk:on-call:1.0.20
-
cpe:2.3:a:splunk:on-call:1.0.22
-
cpe:2.3:a:splunk:on-call:1.0.23
-
cpe:2.3:a:splunk:on-call:1.0.24
-
cpe:2.3:a:splunk:on-call:1.0.25
-
cpe:2.3:a:splunk:on-call:1.0.26
-
cpe:2.3:a:splunk:on-call:1.0.27
-
cpe:2.3:a:splunk:on-call:1.0.28
-
cpe:2.3:a:splunk:on-call:1.0.29
-
cpe:2.3:a:splunk:on-call:1.0.30
-
cpe:2.3:a:splunk:on-call:1.0.31
-
cpe:2.3:a:splunk:on-call:1.0.32
-
cpe:2.3:a:splunk:on-call:1.0.33
-
cpe:2.3:a:splunk:on-call:1.0.34
-
cpe:2.3:a:splunk:on-call:1.0.36
-
cpe:2.3:a:splunk:on-call:1.0.37
-
cpe:2.3:a:splunk:on-call:1.0.38
-
cpe:2.3:a:splunk:on-call:1.0.39
-
cpe:2.3:a:splunk:on-call:1.0.40
-
cpe:2.3:a:splunk:on-call:1.0.42
-
cpe:2.3:a:splunk:on-call:1.0.7
-
cpe:2.3:a:splunk:on-call:1.0.8
-
cpe:2.3:a:splunk:on-call:1.0.9