CVE-2026-76275 in Splunk
Summary
by MITRE • 10/08/2026
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution metadata, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully enforce per-user authorization before it includes job information in search job listings.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The identified vulnerability represents a critical access control failure within Splunk Enterprise, specifically affecting versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. This flaw allows users with limited privileges who do not possess the admin or power roles to retrieve sensitive information regarding search jobs initiated by other users. The core technical issue lies in the insufficient enforcement of per-user authorization checks within a specific Representational State Transfer API endpoint responsible for listing search job metadata. When an authenticated user queries this interface, the system fails to adequately validate whether the requesting user has permission to view the details of the target job before returning the data. Consequently, the API returns comprehensive information including job identifiers, dispatch parameters, result counts, and execution metadata associated with jobs belonging to other users in the environment.
From a technical perspective, this vulnerability is classified under CWE-284 Improper Access Control, as it involves an authorization bypass that allows unauthorized entities to access protected resources. The specific mechanism of exploitation aligns with ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate user credentials but exploit the lack of proper role-based restrictions to escalate their effective privileges regarding data visibility. By accessing job metadata and search query text, an attacker can gain insight into operational workflows, potentially identifying sensitive data processing patterns or discovering internal system configurations that are not intended for general users. The exposure of dispatch parameters may also reveal details about scheduled tasks or automated processes running within the Splunk infrastructure, providing a roadmap for further reconnaissance activities against the security monitoring platform itself.
The operational impact of this vulnerability is significant because it compromises the confidentiality and integrity of the security operations center environment. Search queries often contain sensitive log data, threat intelligence indicators, or internal network topology details that are central to an organization's defense strategy. If lower-privileged users can view these queries and their results, they may extract proprietary information, identify gaps in monitoring coverage, or understand how specific threats are being investigated by security analysts. This capability undermines the principle of least privilege and erodes trust in the access control mechanisms governing the Splunk platform. Furthermore, knowledge of job identifiers and execution metadata could facilitate more targeted attacks against specific search processes or aid in crafting social engineering campaigns based on observed operational behaviors.
To mitigate this risk, organizations running affected versions must immediately upgrade to a patched release where these authorization checks have been corrected. Until an upgrade is feasible, administrators should review role definitions to ensure that no unnecessary permissions are granted through custom roles and restrict access to the specific REST API endpoints involved in search job listing if possible via network-level controls or WAF rules. Regular auditing of user activity logs within Splunk can help detect any unauthorized attempts to query other users' jobs, although the primary remediation remains patching the software to enforce strict role-based access control on all sensitive data retrieval operations.