Vulnerability · Published Aug 19, 2026 · Assigned by cisco
CVE-2026-76348Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise
Low 3.8
In plain English
A low-severity missing authorization in Splunk Enterprise from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a denial of service. The vulnerability is possible because the Search Head Cluster member control endpoints do not require a state-changing Hypertext Transfer Protocol (HTTP) request type before they apply read-only authorization.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.4 – before 10.4.210.2 – before 10.2.610.0 – before 10.0.99.4 – before 9.4.14 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L