CVE-2026-76336: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

Splunk Enterprise versions >=10.2 <10.2.6 and >=10.4 <10.4.2 contain an authorization bypass vulnerability in the SPL2 module management REST API. Users lacking admin or power roles can delete all SPL2 modules across the instance because the API does not properly validate authorization for module deletion requests. This affects exported datasets and functions, potentially disrupting service and compromising system integrity. Versions below 10.2 are not affected.

An attacker with a user role below admin or power can delete all SPL2 modules, including exported datasets and functions, across all apps and users on the Splunk Enterprise instance. This results in loss of data integrity and partial disruption of service. Confidentiality is not impacted, but integrity and availability are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict user roles to prevent unauthorized access to the SPL2 module management REST API. Review and limit permissions for users who do not require module management capabilities.