Missing Authorization in Splunk Enterprise - CVE-2026-76296
Published: October 22, 2026
Vulnerability identifier: #VU156980
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76296
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to create, move, edit, or delete their own sourcetype renaming configurations in apps they do not have permission to access.
The vulnerability exists due to missing app permission checks in Splunk Web when processing sourcetype renaming operations. A remote user can submit sourcetype renaming requests targeting inaccessible apps to create, move, edit, or delete configurations they own within those apps.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-76296
Install security update from vendor's website.
Splunk Enterprise - addressed in versions 9.4.16, 10.0.11, 10.2.8, 10.4.4