CVE-2026-76310 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the "admin" Splunk role. The vulnerability is possible because embedded report access does not block Representational State Transfer (REST) API dispatch archive download requests. For more information see Additional configuration for embedded reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/9.1/report-management/additional-configuration-for-embedded-reports) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
A critical authentication bypass vulnerability exists within specific versions of Splunk Enterprise, including releases prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. This flaw allows an unauthenticated user possessing a valid embedded report token to execute unauthorized operations that compromise the confidentiality and integrity of the Splunk platform. The vulnerability stems from an inconsistency in how access controls are enforced across different interface layers within the application architecture. Specifically, while the web-based dashboard interface correctly restricts certain actions based on role-based permissions, the underlying Representational State Transfer (REST) API does not apply equivalent restrictions to dispatch archive download requests associated with embedded reports. This discrepancy creates a security gap where an attacker can leverage publicly accessible or easily obtainable report tokens to bypass intended access controls and retrieve sensitive backend data structures that should remain protected from unauthenticated entities.
The technical mechanism of this vulnerability involves the exploitation of the search job dispatch functionality. When a user accesses an embedded report, Splunk generates a unique token for session management and authentication within the dashboard context. However, the REST API endpoint responsible for handling requests to download the archive containing the results of that specific search job fails to validate whether the requester has sufficient privileges beyond possessing the initial report token. By constructing a targeted HTTP request to this dispatch archive endpoint using the embedded report token, an attacker can successfully retrieve the associated session material and raw data outputs. This effectively circumvents the role-based access control mechanisms designed to limit visibility of sensitive information based on user roles such as admin, power, or read-only statuses. The ability to download these archives means that any data visible within the context of the compromised report becomes accessible to an unauthenticated actor.
The operational impact of this vulnerability is severe and multifaceted, primarily affecting the confidentiality of organizational data and potentially compromising system integrity depending on the privileges held by the original report owner. If the embedded report was created or accessed by a user with administrative rights, such as someone holding the admin Splunk role, the attacker gains access to all relevant data available to that administrator. This can include sensitive logs, configuration details, network topology information, and other proprietary intelligence stored within the SIEM platform. Furthermore, because the retrieved session material may contain authentication cookies or tokens valid for further API interactions, an attacker could potentially escalate privileges beyond simple data exfiltration. In worst-case scenarios involving administrative accounts, this access vector allows for potential modification of system configurations, creation of new user accounts with elevated privileges, or execution of arbitrary commands if combined with other exploitation techniques targeting the Splunk platform's broader attack surface.
From a classification perspective, this vulnerability aligns closely with CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function within the Common Weakness Enumeration framework. The failure to enforce authentication checks on critical API endpoints constitutes a fundamental breach of security principles regarding access control enforcement. Additionally, in terms of tactical mapping according to MITRE ATT&CK techniques, this behavior is indicative of T1530 Data from Cloud Storage Object or more specifically data exfiltration via non-standard channels such as T1048 Exfiltration Over Alternative Protocol if the API traffic is not monitored by standard security controls. The exploitation path also relates to T1078 Valid Accounts, although in this specific instance, it involves leveraging a valid but insufficiently scoped token for unauthorized data access rather than full account compromise initially.
To mitigate this vulnerability, organizations running affected versions of Splunk Enterprise must immediately upgrade to version 10.4.2 or later, where the REST API dispatch archive download requests are properly secured against unauthenticated access via embedded report tokens. Until an upgrade is feasible, administrators should implement network-level controls such as firewall rules or Web Application Firewall (WAF) policies that restrict direct access to internal Splunk API endpoints from external networks. It is also advisable to review and minimize the use of embedded reports with high-privilege owners in publicly accessible contexts. Regular auditing of role-based user access configurations, as detailed in official Splunk documentation regarding managing users and security, can help identify other potential misconfigurations that might expose similar attack vectors. Ensuring that all API endpoints adhere strictly to the same authentication standards as their corresponding UI counterparts is essential for maintaining a robust defense-in-depth posture against such logic flaws.