CVE-2026-76336 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 (SPL2) modules across all apps and users on the instance through the SPL2 module management Representational State Transfer (REST) API. This could delete exported datasets and functions, affect system integrity, and cause partial service disruption. The vulnerability does not affect Splunk Enterprise versions below 10.2. The vulnerability is possible because the SPL2 module management REST API does not sufficiently authorize and validate module deletion requests. For more information see Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) and Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) in the Splunk documentation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
A critical authorization flaw exists within the SPL2 module management REST API of Splunk Enterprise versions prior to 10.4.2 and 10.2.6, allowing unprivileged users to perform destructive actions that should be restricted to administrators or power users. The vulnerability stems from a failure in access control logic where the API endpoint responsible for deleting Search Processing Language version two modules does not adequately verify whether the requesting user possesses sufficient privileges. Specifically, any authenticated user who lacks both the admin and power roles can exploit this misconfiguration to delete all SPL2 modules across every application and user account on the affected instance. This represents a severe breakdown in role-based access control mechanisms, as the system fails to enforce permission boundaries that are intended to protect critical configuration data from lower-privileged entities.
The operational impact of this vulnerability is significant, affecting both data integrity and service availability. By deleting SPL2 modules, an attacker can remove exported datasets and custom functions that are essential for ongoing search operations and business intelligence workflows. This destruction of module definitions leads directly to partial service disruption, as dependent searches may fail or produce incorrect results due to missing components. The ability to wipe these modules across all apps and users implies a broad scope of damage, potentially requiring extensive manual intervention to restore functionality and reconfigure the environment. Such an action undermines system integrity by removing trusted code artifacts without proper oversight or audit trails that would typically accompany administrative changes.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as it involves unauthorized elevation of privileges through insufficient enforcement of role-based access controls. Furthermore, the exploitation technique corresponds to ATT&CK T1078, Valid Accounts, where an attacker uses legitimate credentials that have been compromised or misused to gain higher-level permissions than intended by the system design. The lack of proper validation on the REST API endpoint allows a standard user account to execute administrative functions, highlighting a gap in input validation and authorization checks at the application layer.
Mitigation for this issue requires immediate patching to Splunk Enterprise version 10.4.2 or later, as well as version 10.2.6 and above, where these access control flaws have been addressed. Until patches are applied, administrators should review user role assignments to ensure that no non-privileged users retain direct API access capabilities that could be leveraged for module manipulation. Additionally, enabling comprehensive audit logging on the SPL2 management endpoints can help detect unauthorized deletion attempts in real time. Organizations must also verify that their internal security policies strictly enforce separation of duties, ensuring that only designated personnel with admin or power roles have write access to critical search infrastructure components.