CVE-2026-76319: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In Splunk Enterprise versions before 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a vulnerability exists due to missing authorization checks when a user attempts to select a Federated Search bundle. A low-privileged user lacking the fsh_manage capability can exploit this to execute remote code. The flaw arises because the Federated Search dispatch flow accepts caller-controlled bundle selection without enforcing the capability that manages federated providers and indexes, enabling unauthorized actions.

An attacker with low privileges can achieve remote code execution, potentially gaining access to all relevant data and impacting system integrity and availability. This elevates the risk of data breaches and system compromise within affected Splunk Enterprise deployments.

Splunk has released official fixes in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that address this vulnerability. Users should upgrade to these or later versions to remediate the issue. Refer to Splunk's official documentation on Federated Search security models and role capabilities for additional context. No alternative mitigations are specified.