Vulnerability · Published Oct 7, 2026 · Assigned by cisco
CVE-2026-76277Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise
Medium 4.1
In plain English
A medium-severity improper input validation in Splunk Enterprise from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory. This can cause distinct native Splunk usernames to share per-user configuration data, and user-management operations can affect the wrong account or fail. For more information see Set up native Splunk authentication (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-the-native-splunk-platform-authentication-scheme/set-up-native-splunk-authentication) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.4 – before 10.4.310.2 – before 10.2.710.0 – before 10.0.109.4 – before 9.4.15 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L