CVE-2026-76312: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. in Splunk Splunk Enterprise

This vulnerability affects Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14. An unauthenticated attacker able to view the HTML source of a page embedding a Splunk report can extract session material that should be protected. The dispatch archive download path does not correctly enforce authorization boundaries for embedded reports, allowing exposure of sensitive session information within archived search-job data. This flaw can lead to unauthorized data access and compromise system integrity. The issue is documented in Splunk's guidance on additional configuration for embedded reports and embedding scheduled reports.

An unauthenticated attacker can gain unauthorized access to sensitive data by exploiting exposed session material in archived search-job data. This compromises confidentiality and integrity of the system's data. The vulnerability has a CVSS 3.1 score of 9.4 (critical), indicating high impact with network attack vector, no privileges or user interaction required, and high confidentiality and integrity impact.

A fix is available in Splunk Enterprise versions 10.4.1, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Refer to Splunk's official documentation on additional configuration for embedded reports and embedding scheduled reports for further guidance. No other mitigation steps are indicated by the vendor advisory.