CVE-2026-76338

Summary

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material. For more information see About distributed search (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-distributed-search/about-distributed-search) and authentication.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/authentication.conf) in Splunk documentation.

Affected Software

VendorProductVersion RangeStatus
SplunkSplunk Enterprise10.4 < 10.4.2affected
SplunkSplunk Enterprise10.2 < 10.2.6affected
SplunkSplunk Enterprise10.0 < 10.0.9affected
SplunkSplunk Enterprise9.4 < 9.4.14affected

Weaknesses

  • CWE-287: When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Workarounds

Turn off legacy distributed search token fallback by setting strictPeerNameValidation = true in the authentication.conf configuration file if you do not use distributed search peers that omit peername. Restart Splunk Enterprise on every node in the distributed environment after applying the setting. For more information see authentication.conf in the Splunk documentation.

References