CVE-2026-76289 in Splunk
Summary
by MITRE • 10/22/2026
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup table files. The affected instance requires a restart to restore service. The vulnerability is possible because the endpoint does not limit resource use when it processes response field selections. For more information see Endpoints reference list (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/introduction/endpoints-reference-list) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/22/2026
A critical resource exhaustion vulnerability exists within Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16, specifically affecting instances where the Representational State Transfer API endpoint for lookup table files fails to enforce adequate limits on resource consumption during response field selection processing. This flaw allows an authenticated user who lacks administrative or power-level privileges to trigger a denial of service condition against the entire Splunk Enterprise instance. The vulnerability stems from insufficient input validation and resource management controls within the REST API handler, which permits maliciously crafted requests that consume excessive system resources such as memory or CPU cycles without restriction based on the caller's role permissions.
The operational impact of this vulnerability is severe, resulting in a complete unavailability of the Splunk Enterprise platform for all other users. When an attacker exploits this flaw by sending specific requests to the affected endpoint, the instance becomes overwhelmed and unresponsive due to resource exhaustion. Restoring normal service operations requires manual intervention, specifically necessitating a full restart of the Splunk Enterprise software on the compromised host or cluster member. This requirement introduces significant downtime and operational disruption for organizations relying on the platform for security information and event management activities.
From a technical classification perspective, this vulnerability aligns with CWE-400, which describes conditions where resources are not properly limited before consumption, leading to resource exhaustion. In terms of adversary tactics and techniques, this behavior corresponds to ATT&CK technique T1499, specifically Endpoint Denial of Service via application layer attacks that target specific services or applications rather than network infrastructure. The vulnerability highlights a gap in role-based access control implementation where low-privilege users are granted the ability to perform actions with disproportionate resource impacts on shared system components.
Mitigation strategies primarily involve upgrading Splunk Enterprise to version 10.4.4, 10.2.8, 10.0.11, or 9.4.16 and later, which address these resource management deficiencies in the REST API endpoint handling logic. Organizations should also review their role-based user access configurations as outlined in Splunk documentation to ensure that sensitive endpoints are appropriately restricted. Implementing network-level rate limiting or web application firewalls can provide additional layers of defense by detecting and blocking anomalous request patterns before they reach the vulnerable application layer, thereby reducing the risk of successful exploitation until patches can be applied.