CVE-2026-76264 in Splunk
Summary
by MITRE • 10/07/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.10, and 9.4.15 represents a critical authorization bypass within the platform's configuration management subsystem. This flaw specifically affects users who do not possess elevated privileges such as admin or power roles, yet they are able to create or modify scripted lookup definitions through raw configuration endpoints. In Splunk architecture, lookups are mechanisms used to enrich events with additional data from external sources, and scripted lookups allow for the execution of custom scripts during this enrichment process. The security boundary intended to restrict such high-impact actions to privileged users is effectively circumvented due to a failure in access control logic within the backend service handling raw configuration writes.
The technical root cause lies in the implementation of the transforms configuration write paths, which are responsible for persisting changes to lookup definitions and their associated settings. When a user submits a request to create or edit a scripted lookup via these endpoints, the system fails to perform an external capability check before saving the new or modified settings. Typically, Splunk enforces role-based access control by verifying that the requesting user has specific capabilities required for certain actions. However, in this instance, the validation logic is either missing or incorrectly implemented for raw configuration updates involving scripted lookups. This allows unprivileged users to inject arbitrary script definitions into the system's configuration files without triggering the standard permission checks that would normally block such operations.
The operational impact of this vulnerability is severe because it enables privilege escalation and potential remote code execution within the Splunk environment. Scripted lookups are executed by the Splunk daemon processes, which typically run with elevated privileges relative to the end-user context. By injecting a malicious script through a scripted lookup definition, an attacker can achieve arbitrary command execution on the host system running Splunk Enterprise. This effectively grants the unprivileged user full control over the underlying operating system, allowing them to exfiltrate sensitive data stored within the SIEM platform, pivot into other network segments, or establish persistence mechanisms for long-term access. The ability to bypass role-based restrictions undermines the fundamental security model of the application and compromises the integrity of the entire logging and monitoring infrastructure.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves a failure to enforce proper authorization levels before performing sensitive operations. Furthermore, from an adversary perspective, this flaw facilitates lateral movement and privilege escalation within the ATT&CK framework, specifically under techniques related to exploitation for credential access or execution of malicious commands via system services. The use of raw configuration endpoints also highlights issues with CWE-749, where exposed dangerous methods allow attackers to bypass intended restrictions.
To mitigate this risk, organizations running affected versions must immediately upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.10, or 9.4.15 and later, as these releases contain the necessary patches for the authorization checks in the transforms configuration write paths. Until an upgrade is feasible, administrators should restrict network access to raw configuration endpoints by implementing strict firewall rules that limit connectivity to trusted management interfaces only. Additionally, enforcing multi-factor authentication on all Splunk accounts and regularly auditing user roles can help detect unauthorized attempts to modify configurations. It is also advisable to review existing scripted lookup definitions for any anomalies or scripts added by unprivileged users during the window of exposure.