CVE-2026-76275 Splunk CVE debrief

Who should care

Splunk Enterprise administrators and security teams responsible for managing user access and authorization should assess exposure, review user access controls, and verify REST API usage to prevent potential security consequences. They should also review and update Splunk Enterprise versions, restrict access to the REST API, and monitor search job listings and job metadata access.

Why it matters

The improper authorization vulnerability in Splunk Enterprise allows users to access search query text and job metadata for jobs belonging to other users, potentially leading to unauthorized access to sensitive information. Splunk Enterprise administrators and security teams should assess exposure, review user access controls, and verify REST API usage to prevent potential security consequences.

• Potential unauthorized access to sensitive search query text and job metadata
• Possible exposure of job identifiers, dispatch parameters, result counts, and execution metadata
• Requires verification of user access controls and REST API usage
• Necessitates review of current user roles and permissions

Technical summary

The vulnerability exists in Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, allowing users without 'admin' or 'power' roles to access search query text and job metadata for jobs belonging to other users through the REST API. This improper authorization vulnerability can lead to unauthorized access to sensitive information. Affected users should review and update Splunk Enterprise versions, restrict access to the REST API, and monitor search job listings and job metadata access. The CVE record and source item provide details on the vulnerability, but further verification is necessary to confirm affected scope and severity.

Defensive priority

Medium priority for Splunk Enterprise administrators and security teams

Recommended defensive actions

• Review and update Splunk Enterprise versions to 10.4.3, 10.2.7, 10.0.10, or 9.4.15
• Restrict access to the REST API for users without 'admin' or 'power' roles
• Monitor search job listings and job metadata access
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the improper authorization vulnerability in Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerability allows users without 'admin' or 'power' roles to access search query text and job metadata for jobs belonging to other users through the REST API. Evidence is limited to the provided CVE record and source item, and further verification is necessary to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.