CVE-2026-76338

Received Received - Intake

Authentication Token Forgery in Splunk Enterprise

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material. For more information see About distributed search (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-distributed-search/about-distributed-search) and authentication.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/authentication.conf) in Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76338

EUVD

EUVD-2026-62903

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	9.4.14
splunk	splunk_enterprise	10.0.9
splunk	splunk_enterprise	10.2.6
splunk	splunk_enterprise	to 10.4.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability in Splunk Enterprise below versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 allows an unauthenticated user with access to a trusted distributed search private key to forge an administrative session token. This token can be used to access all data, alter system integrity, and disrupt service availability.

Detection Guidance

Detecting this vulnerability requires checking Splunk Enterprise versions for affected releases (below 10.4.2, 10.2.6, 10.0.9, or 9.4.14). Verify distributed search configurations and ensure no unauthorized access to private keys. Review authentication tokens and search peer configurations for anomalies.

Impact Analysis

An attacker could gain full administrative access to your Splunk Enterprise system, leading to unauthorized data access, data manipulation, or service disruption. This could result in data breaches, loss of sensitive information, or operational downtime.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access or breaches. Organizations may face legal penalties, reputational damage, and loss of trust from customers and regulators.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76338. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70