CVE-2026-76310: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, an unauthenticated attacker possessing an embedded report token can exploit insufficient access restrictions to download the search job dispatch archive via the REST API. This archive contains session material that can be used to access data and perform actions with the privileges of the report owner, including administrative actions if the owner holds the admin role. The vulnerability is due to embedded report access not blocking REST API dispatch archive download requests, allowing unauthorized data access and potential system compromise.

An unauthenticated attacker can gain unauthorized access to sensitive data and potentially perform administrative actions on the Splunk Enterprise system by exploiting this vulnerability. This compromises confidentiality, integrity, and availability to a high degree, as the attacker can act with the privileges of the report owner, including admin-level capabilities.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Refer to Splunk's official documentation on additional configuration for embedded reports and role-based user access for further guidance. No other mitigation steps are indicated by the vendor advisory.