SB20261022248 - Multiple vulnerabilities in Splunk Enterprise
Published: October 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 vulnerabilities.
1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-76287)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to read or delete Data Management SPL2 preview jobs and results belonging to other users.
The vulnerability exists due to missing job ownership validation in the Splunk Enterprise Data Management REST API when handling preview job requests. A remote user can use the preview_data_management_pipeline or edit_data_management_pipeline_job capability to request preview jobs outside their ownership scope and read or delete those jobs and results.
The affected API is available only when the Edge Processor feature is enabled, which is not the default configuration.
2) Resource exhaustion (CVE-ID: CVE-2026-76288)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by making Splunk Web stop responding to requests.
The vulnerability exists due to unrestricted resource consumption in Splunk Web request-header parsing when processing requests to the JavaScript logger endpoint. A remote attacker can send a single request with a specially crafted Content-Type header to make Splunk Web unavailable.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-76289)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service by making the Splunk Enterprise instance unavailable to other users.
The vulnerability exists due to resource allocation without limits in the Splunk Enterprise REST API endpoint for lookup table files when processing response field selections. A remote user can send a specially crafted request specifying response fields to exhaust resources and make the instance unavailable.
4) Resource exhaustion (CVE-ID: CVE-2026-76290)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by exhausting system resources and potentially making the Splunk daemon stop responding.
The vulnerability exists due to unrestricted resource consumption in the Splunk Pipeline Builders app's Edge Processor package download endpoint when reading and base64-encoding the complete package in memory for each unauthenticated download request. A remote attacker can send repeated package download requests to consume excessive system resources and potentially make the Splunk daemon unavailable.
5) Improper access control (CVE-ID: CVE-2026-76291)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose or alter Splunk Enterprise data or disrupt service availability.
The vulnerability exists due to improper access control in the Splunk Enterprise search scheduler when executing scheduled searches without applying safeguards for risky SPL commands. A remote user can use the schedule_search capability to schedule searches containing risky commands and disclose or alter data or disrupt service availability.
6) Missing Authorization (CVE-ID: CVE-2026-76292)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to read mobile alert notification data belonging to other users.
The vulnerability exists due to missing user-level authorization in Splunk Secure Gateway App Key Value Store collections when handling read requests through REST API endpoints. A remote user can request other users' mobile alert notification records through the affected endpoints to disclose their notification data.
7) Code Injection (CVE-ID: CVE-2026-76293)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to execute arbitrary operating system commands with the permissions of the account running Splunk Enterprise.
The vulnerability exists due to code injection in Splunk Web Manager XML expression evaluation when opening an affected configuration in the Manager page. A remote privileged user can use the edit_manager_xml capability to supply expressions with insufficiently restricted syntax and open the configuration to execute arbitrary operating system commands as the account running Splunk Enterprise.
8) Missing Authorization (CVE-ID: CVE-2026-76294)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to move field extractions or field transformations into apps they do not have permission to access.
The vulnerability exists due to missing destination app authorization in the Splunk Enterprise REST API when processing field extraction and field transformation move operations. A remote user can submit move requests targeting apps for which they lack read access to make unauthorized changes to the placement of these knowledge objects.
9) Improper Neutralization of Special Elements in Data Query Logic (CVE-ID: CVE-2026-76295)
CWE-ID: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to view dashboard and report listings beyond the requested filter scope.
The vulnerability exists due to improper neutralization of special characters in Splunk Secure Gateway REST API filter construction when processing dashboard and report requests. A remote user can supply crafted filter values to inject SPL syntax and retrieve listings beyond the requested filter scope.
Returned listings remain limited to objects that the requesting user is permitted to access.
10) Missing Authorization (CVE-ID: CVE-2026-76296)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to create, move, edit, or delete their own sourcetype renaming configurations in apps they do not have permission to access.
The vulnerability exists due to missing app permission checks in Splunk Web when processing sourcetype renaming operations. A remote user can submit sourcetype renaming requests targeting inaccessible apps to create, move, edit, or delete configurations they own within those apps.
11) Cross-site request forgery (CVE-ID: CVE-2026-76297)
CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to turn off all federated search providers and temporarily prevent federated searches from retrieving remote dataset data.
The vulnerability exists due to cross-site request forgery in the Splunk Web federated provider REST API when accepting GET requests for provider state changes. A remote attacker can phish a user with the edit_federated_providers capability into initiating a crafted browser request to turn off all federated search providers and temporarily disrupt remote dataset retrieval.
12) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2026-76298)
CWE-ID: CWE-321 - Use of Hard-coded Cryptographic Key
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to derive the PostgreSQL sidecar database superuser password and execute arbitrary operating system commands as the account running Splunk Enterprise on search head cluster members.
The vulnerability exists due to use of a hard-coded cryptographic key in the Splunk Enterprise PostgreSQL sidecar service when deriving a privileged database password from the search head cluster identifier. A remote user can obtain this identifier from search job logs and derive the database superuser password to execute arbitrary operating system commands as the account running Splunk Enterprise on search head cluster members.
13) Improper access control (CVE-ID: CVE-2026-76299)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to potentially access resources or perform operations without proper authorization.
The vulnerability exists due to improper access control in Splunk Enterprise when enforcing access restrictions. A remote user can potentially bypass those restrictions to access resources or perform operations that should be prohibited.
14) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-76300)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to potentially disrupt the availability or integrity of application resources.
The vulnerability exists due to improper control of a resource through its lifetime in Splunk Enterprise when managing application resources. A remote user can potentially exploit resource lifecycle handling errors to interfere with resource availability or integrity.
15) Protection mechanism failure (CVE-ID: CVE-2026-76301)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to potentially bypass security protections.
The vulnerability exists due to protection mechanism failure in Splunk Enterprise when enforcing security safeguards. A remote user can potentially exploit ineffective safeguards to bypass the protections they are intended to provide.
16) Improper Neutralization (CVE-ID: CVE-2026-76302)
CWE-ID: CWE-707 - Improper Neutralization
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially alter how application data is interpreted.
The vulnerability exists due to improper neutralization in Splunk Enterprise when processing data containing potentially significant special elements. A remote attacker can potentially supply data with elements that are not adequately neutralized to cause unintended interpretation during processing.
Remediation
Install update from vendor's website.