CVE-2026-76348
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Summary
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a denial of service. The vulnerability is possible because the Search Head Cluster member control endpoints do not require a state-changing Hypertext Transfer Protocol (HTTP) request type before they apply read-only authorization.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Splunk | Splunk Enterprise | 10.4 < 10.4.2 | affected |
| Splunk | Splunk Enterprise | 10.2 < 10.2.6 | affected |
| Splunk | Splunk Enterprise | 10.0 < 10.0.9 | affected |
| Splunk | Splunk Enterprise | 9.4 < 9.4.14 | affected |
Weaknesses
- CWE-862: The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
Workarounds
Remove the list_search_head_clustering capability from Splunk roles if they do not need Search Head Cluster status information. For more information see Define roles on the Splunk platform with capabilities in the Splunk documentation.
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.