CVE-2026-76350 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges, expose all relevant data, and affect system integrity and availability on the search head. The vulnerability is possible because the search scheduler passes a system-level authentication context rather than the action owner context to the email alert action when it renders PDF attachments. For more information see alert_actions.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/alert_actions.conf) in the Splunk documentation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
A critical privilege escalation vulnerability exists within Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, specifically affecting the email alert action workflow when PDF attachments are configured. This flaw allows a user possessing only the schedule_search capability, which is typically intended for limited search execution rights, to execute arbitrary Search Processing Language commands with system-level privileges. The root cause lies in how the Splunk search scheduler handles authentication contexts during the rendering of PDF attachments for email alerts. Instead of passing the context of the action owner who initiated the alert, the scheduler erroneously passes a system-level authentication context to the underlying process responsible for generating and attaching the PDF. This misconfiguration effectively bypasses standard access controls, granting lower-privileged users elevated permissions that they should not possess under normal operational circumstances.
The technical flaw centers on the separation of duties and identity management within Splunk's alerting subsystem. When an email alert is triggered by a scheduled search, the system must determine which user context to use for subsequent actions such as generating attachments or sending emails. In this vulnerable scenario, the PDF generation component operates under the assumption that it has full administrative rights because it inherits the scheduler's elevated privileges rather than validating against the initiating user's role permissions. This design oversight means that any command executed during the alert processing phase, including those embedded in SPL queries used to populate or format the report data, runs with unrestricted access to the Splunk infrastructure. Consequently, an attacker can leverage this mechanism to perform actions far beyond their intended scope, such as reading sensitive configuration files, accessing restricted indexes, or modifying system settings.
The operational impact of this vulnerability is severe, encompassing risks to confidentiality, integrity, and availability. From a confidentiality standpoint, attackers can expose all relevant data accessible by the Splunk service account, including logs containing personally identifiable information, financial records, or intellectual property that were not intended for public view. The integrity risk arises because the ability to execute arbitrary SPL commands with system privileges allows an attacker to manipulate search results, alter configurations, or potentially inject malicious code into processed data streams. Furthermore, availability is threatened as resource-intensive searches or destructive commands could be executed at scale, leading to denial of service conditions on the search head nodes that handle these alert actions. This represents a significant breach in the principle of least privilege, undermining the security model designed to restrict user capabilities based on their assigned roles.
This vulnerability aligns with CWE-269, Improper Privilege Management, as it involves an actor obtaining elevated privileges without proper authorization due to flawed identity verification logic. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically the sub-category of Default Accounts or Service Accounts if exploited via automated scheduling, and potentially T1562, Impair Defenses, by disabling logging or altering security configurations through SPL commands. To mitigate this risk, organizations must immediately upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later, where the authentication context passing mechanism has been corrected to respect the action owner's permissions rather than defaulting to system-level access for PDF rendering tasks. Until patches are applied, administrators should restrict the schedule_search capability strictly to trusted users and monitor alert execution logs for unusual SPL command patterns that indicate exploitation attempts. Additionally, reviewing alert_actions.conf configurations can help identify instances where email alerts with PDF attachments are configured by lower-privileged accounts, allowing for temporary manual intervention or role reassignment to reduce exposure while updates are deployed.