CVE-2026-76296

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations. For more information see Rename source types at search time (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time) in the Splunk documentation.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2026-1007	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*

History

30 Oct 2026, 15:36

Type	Values Removed	Values Added
References	~~() https://advisory.splunk.com/advisories/SVD-2026-1007 -~~	() https://advisory.splunk.com/advisories/SVD-2026-1007 - Vendor Advisory
CPE		cpe:2.3:a:splunk:splunk:::::enterprise:::*
First Time		Splunk splunk Splunk

21 Oct 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 23:17

Updated : 2026-10-30 15:36

NVD link : CVE-2026-76296

Mitre link : CVE-2026-76296

CVE.ORG link : CVE-2026-76296

JSON object : View

Products Affected

splunk

splunk

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-76296", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76296", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T15:39:55.591361Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "modules": ["Splunk Web"], "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.4", "lessThan": "10.4.4", "versionType": "custom"}, {"status": "affected", "version": "10.2", "lessThan": "10.2.8", "versionType": "custom"}, {"status": "affected", "version": "10.0", "lessThan": "10.0.11", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.16", "versionType": "custom"}]}]}], "published": "2026-10-21T23:17:27.570", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-1007", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the \"admin\" or \"power\" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access.\nThe vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations.\nFor more information see Rename source types at search time (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time) in the Splunk documentation."}], "lastModified": "2026-10-30T15:36:42.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "EF97059C-A659-4440-A445-89E3B10DBD62", "versionEndExcluding": "9.4.16", "versionStartIncluding": "9.4.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "99E63815-5C85-4C08-A816-07FFE81E99A3", "versionEndExcluding": "10.0.11", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "AEDDF349-01DA-4A4D-9970-26B43CFD5118", "versionEndExcluding": "10.2.8", "versionStartIncluding": "10.2.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "497ADE2D-68CE-4726-BD62-2E8E2432A3BF", "versionEndExcluding": "10.4.4", "versionStartIncluding": "10.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}