CVE-2026-76405Information Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app
Updated under an hour ago ()
Does this affect you?
It affects Splunk On-Call (VictorOps) and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store). The exposure is possible because the Splunk On-Call (VictorOps) app does not fully mask the API key before storing it in a KV Store collection that the user can read. For more information see About the app key value store (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/administer-the-app-key-value-store/about-the-app-key-value-store) in the Splunk documentation.
- CVSS
- 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness (CWE)
- CWE-312
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- cisco
- NVD analysis
- Analyzed
- Record last updated
- Aug 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Splunk Splunk On-Call (VictorOps) splunk:on_call_victorops (from the name) | from 1.0 before 1.0.43 | CNA record |
splunk on-call splunk:on-call | before 1.0.43 | NVD |
References
- https://advisory.splunk.com/advisories/SVD-2026-0808vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.