CVE-2026-76275

Received Received - Intake

Splunk Enterprise Unauthorized Job Metadata Access via REST API

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution metadata, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully enforce per-user authorization before it includes job information in search job listings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76275

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2
Splunk	Splunk	Enterprise 10.0
Splunk	Splunk	Enterprise 9.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. A non-admin or non-power user can access search query text and job metadata belonging to other users through a REST API. The API does not properly enforce authorization checks before exposing job details like identifiers, dispatch parameters, result counts, and execution metadata.

Impact Analysis

An attacker with limited access could view sensitive search queries and job details of other users. This may lead to information disclosure, including business data or operational insights. While it does not allow modification or deletion, unauthorized access to metadata could still pose privacy and security risks.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by allowing unauthorized access to user data and metadata. Organizations using affected Splunk versions may face compliance violations, potential fines, and reputational damage due to insufficient access controls.

Mitigation Strategies

Upgrade Splunk Enterprise to a patched version (10.4.3, 10.2.7, 10.0.10, or 9.4.15 or later) to address the authorization flaw in the REST API.

Hi! I’m here to help you understand CVE-2026-76275. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70