CVE-2026-76275

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution metadata, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully enforce per-user authorization before it includes job information in search job listings.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2026-1001	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*

History

14 Oct 2026, 12:05

Type	Values Removed	Values Added
First Time		Splunk splunk Splunk
References	~~() https://advisory.splunk.com/advisories/SVD-2026-1001 -~~	() https://advisory.splunk.com/advisories/SVD-2026-1001 - Vendor Advisory
CPE		cpe:2.3:a:splunk:splunk:::::enterprise:::*

07 Oct 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-07 21:17

Updated : 2026-10-14 12:05

NVD link : CVE-2026-76275

Mitre link : CVE-2026-76275

CVE.ORG link : CVE-2026-76275

JSON object : View

Products Affected

splunk

splunk

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-76275", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76275", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-09T16:15:41.415449Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "modules": ["REST API"], "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.4", "lessThan": "10.4.3", "versionType": "custom"}, {"status": "affected", "version": "10.2", "lessThan": "10.2.7", "versionType": "custom"}, {"status": "affected", "version": "10.0", "lessThan": "10.0.10", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.15", "versionType": "custom"}]}]}], "published": "2026-10-07T21:17:18.617", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-1001", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution metadata, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully enforce per-user authorization before it includes job information in search job listings."}], "lastModified": "2026-10-14T12:05:55.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "A49E689F-BF81-4C8D-953B-13D67B2FCA07", "versionEndExcluding": "9.4.15", "versionStartIncluding": "9.4.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "821853EA-D03C-4017-95A9-3770CE48BE8C", "versionEndExcluding": "10.0.10", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "37593BC0-5F11-410C-B823-195F5BFAD2BF", "versionEndExcluding": "10.2.7", "versionStartIncluding": "10.2.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "1268F2CB-E517-45A6-917E-9C1FDBA6CA0A", "versionEndExcluding": "10.4.3", "versionStartIncluding": "10.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}