CVE-2026-76344 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer (REST) API endpoint and affect system integrity on the host. The vulnerability is possible because Splunk Enterprise does not validate the search identifier before using it to create a dispatch directory. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
A critical security vulnerability exists within Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that allows unauthenticated or low-privileged users to compromise system integrity through improper input validation of search identifiers. This flaw specifically affects the Representational State Transfer API endpoint responsible for handling dispatch metadata. Under normal operational parameters, Splunk Enterprise enforces strict role-based access controls where only users possessing admin or power roles are permitted to execute complex searches and manage job states. However, due to a failure in validating the format and content of the search identifier supplied by the client, an attacker can manipulate this parameter to write files outside of the intended sandboxed directories.
The technical root cause lies in the application's handling of user-supplied input during the dispatch process. When a request is made to create or modify a dispatch directory based on a provided search ID, the software fails to sanitize path traversal sequences or validate that the identifier conforms to expected alphanumeric constraints. This lack of validation enables an attacker to supply crafted strings containing relative paths such as dot-dot-slash sequences. By exploiting this mechanism, a user with minimal privileges can effectively bypass role-based restrictions and write arbitrary files to any location on the host operating system where the Splunk service has write permissions.
The operational impact of this vulnerability is severe as it directly undermines the principle of least privilege and compromises the integrity of the underlying host environment. An attacker who successfully exploits this flaw could overwrite critical configuration files, inject malicious scripts into executable directories, or modify log files to cover their tracks. This capability effectively grants an unprivileged user a foothold for further exploitation, potentially leading to remote code execution if combined with other vulnerabilities or misconfigurations that allow the execution of written artifacts. The ability to affect system integrity means that even users who are not intended to have administrative capabilities can destabilize the security posture of the entire Splunk deployment and its host infrastructure.
Mitigation strategies primarily involve upgrading to a patched version of Splunk Enterprise, specifically versions 10.4.2 or later for the 10.x branch, 10.2.6 for the 10.2 branch, 10.0.9 for the 10.0 branch, and 9.4.14 for the 9.4 branch. These updates include fixes that enforce strict validation on search identifiers to prevent path traversal attacks. In environments where immediate patching is not feasible, administrators should implement network-level controls such as firewalls or web application firewalls to restrict access to the affected REST API endpoints only from trusted internal sources. Additionally, ensuring that Splunk services run with minimal file system permissions can limit the scope of damage an attacker could inflict by writing files to restricted directories.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-73 External Control of File Name or Path. The exploitation technique maps directly to ATT&CK T1564.008 Host File System Modification via Hidden Files and Directories, as well as T1059 Command and Scripting Interpreter if the written files are executed. Security teams should monitor for unusual API calls involving dispatch metadata creation from low-privileged accounts and review file system changes in Splunk's operational directories to detect potential exploitation attempts.