CVE-2026-76348 PUBLISHED

Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise

Assigner: cisco
Reserved: 19.08.2026 Published: 19.08.2026 Updated: 19.08.2026

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a denial of service. The vulnerability is possible because the Search Head Cluster member control endpoints do not require a state-changing Hypertext Transfer Protocol (HTTP) request type before they apply read-only authorization.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 3.8

Product Status

Vendor Splunk
Product Splunk Enterprise
Versions
  • affected from 10.4 to 10.4.2 (excl.)
  • affected from 10.2 to 10.2.6 (excl.)
  • affected from 10.0 to 10.0.9 (excl.)
  • affected from 9.4 to 9.4.14 (excl.)

Workarounds

Remove the list_search_head_clustering capability from Splunk roles if they do not need Search Head Cluster status information. For more information see Define roles on the Splunk platform with capabilities in the Splunk documentation.

Solutions

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.

References

Problem Types

  • The software does not perform an authorization check when an actor attempts to access a resource or perform an action. cwe