rewindex

RewindexCVEsSplunk

CVE-2026-76352: Improper Authorization through the REST API in Splunk Enterprise

High · CVSS 8.8 (CVSS 3.1)EPSS 0.42%, 36th percentilePublished Updated Assigner: cisco

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running Splunk Enterprise, which could allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because the generic transforms configuration endpoints do not enforce the capabilities required to create or edit external lookup definitions. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) and limits.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/limits.conf) in the Splunk documentation.

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · CWE-285

Tracked companies

Splunk

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Splunk: Splunk Enterprise

References

All CVEsMarkdownJSON