Authorization bypass through user-controlled key in Splunk Enterprise - CVE-2026-76287
Published: October 22, 2026
Vulnerability identifier: #VU156971
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76287
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read or delete Data Management SPL2 preview jobs and results belonging to other users.
The vulnerability exists due to missing job ownership validation in the Splunk Enterprise Data Management REST API when handling preview job requests. A remote user can use the preview_data_management_pipeline or edit_data_management_pipeline_job capability to request preview jobs outside their ownership scope and read or delete those jobs and results.
The affected API is available only when the Edge Processor feature is enabled, which is not the default configuration.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-76287
Install security update from vendor's website.
Splunk Enterprise - addressed in versions 9.4.16, 10.0.11, 10.2.8, 10.4.4