CVE-2026-76271 in Splunk
Summary
by MITRE • 10/08/2026
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer (REST) API endpoint in the Discover Splunk Observability Cloud app. The vulnerability is possible because the app uses an inefficient regular expression to validate input submitted through the endpoint. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), Splunk Observability Cloud previews (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/observability/splunk-observability-cloud-previews), and restmap.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/restmap.conf) in the Splunk documentation.
Splunk Enterprise versions 9.4.x are not affected.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
A critical denial of service vulnerability exists within the Discover Splunk Observability Cloud application for specific legacy and current releases of Splunk Enterprise, including versions prior to 10.4.3, 10.2.7, and 10.0.10. This flaw allows a low-privileged user who lacks administrative or power-level roles to trigger a service disruption against a Representational State Transfer API endpoint associated with the observability app. The root cause of this vulnerability lies in the implementation of an inefficient regular expression used for input validation within the application logic. When maliciously crafted input is submitted through this specific REST interface, the regex engine enters a state of catastrophic backtracking or excessive computational consumption, leading to resource exhaustion that effectively denies service to legitimate users and potentially destabilizes the underlying Splunk instance.
The technical nature of this flaw aligns with Common Weakness Enumeration category CWE-400, which covers uncontrolled resource consumption often resulting from inefficient algorithmic complexity in input processing. Specifically, the vulnerability exploits poor regular expression design where backtracking paths are not bounded or optimized for worst-case scenarios. This allows an attacker to craft inputs that force the regex engine into exponential time complexity relative to input length. In the context of Splunk Enterprise architecture, such resource exhaustion can impact not only the specific app but potentially broader system performance depending on how resources are allocated and shared across services within the platform.
From a threat actor perspective, this vulnerability is particularly concerning because it does not require high-level privileges for exploitation. The requirement that the attacker must hold at least some basic role in Splunk Enterprise lowers the barrier to entry significantly compared to unauthenticated attacks. This scenario maps closely to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via application layer exploits. An adversary with low-level access could leverage this flaw as part of a broader campaign to disrupt monitoring capabilities or create chaos within the security operations environment without needing to escalate privileges first.
The operational impact of exploiting this vulnerability includes the potential suspension of observability data collection and analysis, which are critical for maintaining visibility into infrastructure health and security events. For organizations relying on Splunk Observability Cloud integrations, a denial of service could lead to blind spots in monitoring dashboards and alerting systems during an incident response window. Furthermore, repeated exploitation attempts may cause instability in the web server components handling REST API requests, potentially requiring manual intervention or restarts by system administrators to restore normal operations.
Mitigation strategies primarily involve upgrading Splunk Enterprise to a patched version that addresses this regular expression inefficiency. Administrators should ensure they are running at least version 10.4.3, 10.2.7, or 10.0.10 depending on their current release track. For environments where immediate patching is not feasible due to operational constraints, implementing network-level access controls can provide temporary relief by restricting API endpoint accessibility to only those IP addresses and user agents that are expected to interact with the observability app. Additionally, reviewing role-based access policies as outlined in Splunk documentation helps ensure that users have minimal necessary privileges, reducing the pool of potential attackers who could attempt exploitation. Monitoring logs for unusual patterns of REST API requests or spikes in CPU usage associated with regex processing can also aid in early detection and response to attempted exploits.