CVE-2026-76291: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. in Splunk Splunk Enterprise

This vulnerability in Splunk Enterprise arises because the search scheduler component fails to enforce SPL safeguards on scheduled searches. Users with the schedule_search capability can exploit this to run risky SPL commands that may lead to unauthorized data disclosure, data modification, or denial of service. The issue affects versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16. The vulnerability is documented under CVE-2026-76291 with a CVSS v3.1 score of 8.8, indicating high severity. The vendor documentation references SPL safeguards for risky commands and the authorize.conf configuration for managing user roles and permissions.

An attacker with schedule_search capability can bypass intended security controls in the scheduled search workflow, potentially leading to unauthorized disclosure or modification of Splunk Enterprise data and disruption of service availability. The impact includes confidentiality, integrity, and availability compromises.

A fix is available in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 and later. Users should upgrade to these or newer versions to remediate the vulnerability. Additionally, review and restrict the schedule_search capability to trusted roles only. Consult Splunk's official documentation on SPL safeguards for risky commands and authorize.conf for proper role configuration.