CVE-2026-76269

Received Received - Intake

Information Disclosure in Splunk Enterprise via REST API

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job metadata, results, and preview results, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully validate job ownership before returning search job information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76269

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2
Splunk	Splunk	Enterprise 10.0
Splunk	Splunk	Enterprise 9.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. A non-admin user can exploit a user-controlled job identifier to access search job information from other users via a REST API. This includes search queries, metadata, results, and preview results, due to insufficient job ownership validation.

Impact Analysis

An attacker with limited access could steal sensitive search data from other users, including confidential queries or results. This could lead to data breaches, unauthorized information exposure, or misuse of internal data.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization. For HIPAA, it may compromise protected health information if search jobs contain such data. Non-compliance risks fines and legal penalties.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.3, 10.2.7, 10.0.10, or 9.4.15 or later) to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76269. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70