CVE-2026-76352 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running Splunk Enterprise, which could allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the generic transforms configuration endpoints do not enforce the capabilities required to create or edit external lookup definitions. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) and limits.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/limits.conf) in the Splunk documentation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
A critical privilege escalation vulnerability exists within Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, stemming from an improper access control mechanism in the generic configuration endpoints responsible for managing scripted lookups. This flaw allows authenticated users who lack administrative or power-level privileges to create or modify external lookup definitions without triggering the necessary role-based capability checks that are typically enforced through other parts of the platform's security model. By exploiting this gap, a low-privileged user can inject malicious logic into the system via these generic endpoints, effectively bypassing standard authorization restrictions designed to prevent unauthorized configuration changes.
The technical core of this vulnerability lies in the failure of the transforms configuration endpoints to validate whether the requesting user possesses specific capabilities required for editing external lookup definitions. In Splunk's security architecture, certain actions are gated behind roles such as admin or power, which grant elevated permissions including the ability to execute system-level commands and access sensitive data stores. However, because these generic endpoints do not enforce the same rigorous capability checks, an attacker can manipulate configuration files that dictate how lookups behave during search operations. This misconfiguration creates a pathway for unauthorized modification of critical system components that govern data processing and retrieval logic.
The operational impact of this vulnerability is severe, as it enables arbitrary code execution with the privileges of the user account running the Splunk Enterprise service process. When an attacker successfully deploys a malicious scripted lookup, any subsequent search operation utilizing that lookup will execute the injected script under the context of the Splunk service account rather than the authenticated user's limited permissions. This elevation allows the attacker to read all relevant data indexed within the platform, including sensitive logs and proprietary information, leading to a complete compromise of confidentiality. Furthermore, the ability to modify system configurations affects integrity by allowing unauthorized changes to operational parameters, while potential resource exhaustion or disruption of search services impacts availability, thereby undermining the reliability of the entire security monitoring infrastructure.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as it involves a user being granted capabilities beyond their assigned role due to flawed access control logic. From an offensive perspective, this technique corresponds to ATT&CK T1078, Valid Accounts, where attackers leverage legitimate credentials and exploit configuration weaknesses to escalate privileges within the environment. The exploitation chain typically follows patterns associated with CWE-94, Improper Control of Generation of Code, since the vulnerability facilitates the injection and execution of arbitrary scripts through misconfigured lookup definitions that are subsequently processed by the application engine.
To mitigate this risk, organizations must immediately upgrade Splunk Enterprise to version 10.4.2 or later, where these access control checks have been corrected in the generic configuration endpoints. Until an upgrade is feasible, administrators should review and restrict access to the affected API endpoints using network-level controls such as firewalls or reverse proxies that enforce strict authentication policies for any requests targeting lookup management functions. Additionally, implementing least-privilege principles by auditing user roles ensures that no single account holds excessive permissions unnecessarily, reducing the blast radius if a low-privileged account is compromised. Regular monitoring of configuration changes and audit logs can also help detect unauthorized modifications to lookup definitions before they are executed during search operations.