CVE-2026-76297: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. in Splunk Splunk Enterprise

This vulnerability in Splunk Enterprise involves insufficient verification of whether a well-formed, valid, and consistent request was intentionally submitted by the user. Specifically, the federated provider REST API accepts GET requests that alter provider state, which should typically be restricted to methods like POST. An unauthenticated attacker can exploit this by phishing a user with the edit_federated_providers capability to perform an unintended action that disables all federated search providers. This leads to temporary denial of federated search functionality for remote datasets. The vulnerability affects versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16.

An attacker cannot directly exploit this vulnerability without user interaction; it requires phishing a user with specific privileges. Successful exploitation results in temporary disabling of all federated search providers, causing federated searches to fail in retrieving data from remote datasets. There is no confidentiality impact, but integrity is low and availability impact is low due to temporary disruption.

Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, or 9.4.16 or later where this issue is fixed. Until patched, users with the edit_federated_providers capability should be cautious of phishing attempts that could trick them into submitting unintended requests. Review role assignments to limit this capability to trusted users. Since the vulnerability requires user interaction, user awareness training on phishing risks is also recommended.