CVE-2026-76278

Received Received - Intake

Information Disclosure in Splunk Enterprise

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Representational State Transfer (REST) API to access permission grants for SPL2 modules that the user does not have permission to view. The vulnerability is possible because Splunk Enterprise does not verify that the user can read the requested app before the affected REST API returns SPL2 module permission grants. For more information see Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) and Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) in the Splunk documentation. Splunk Enterprise versions 9.4.x are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76278

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2
Splunk	Splunk	Enterprise 10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10. A user with the edit_spl2_module_permissions capability can use a REST API to access permission grants for SPL2 modules they are not authorized to view. The issue occurs because Splunk does not verify if the user can read the requested app before returning the module permissions.

Detection Guidance

This vulnerability can be detected by checking Splunk Enterprise versions for affected releases (below 10.4.3, 10.2.7, or 10.0.10). Verify if users with the edit_spl2_module_permissions capability can access unauthorized SPL2 module permissions via REST API calls. Review Splunk logs for unusual API access patterns or permission-related queries.

Impact Analysis

An attacker with the edit_spl2_module_permissions role could exploit this to view unauthorized SPL2 module permissions, potentially leading to information disclosure. This could allow them to gather sensitive data or escalate privileges within the Splunk environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR or HIPAA. Unauthorized disclosure of permissions may result in data breaches, triggering regulatory penalties and reputational damage.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, or 10.0.10 or later to address the vulnerability. Ensure no users hold the edit_spl2_module_permissions capability unless absolutely necessary.

Hi! I’m here to help you understand CVE-2026-76278. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70