CVE-2026-76338: When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the distributed search authentication token endpoint insufficiently verifies identity claims. Specifically, it does not require signed requests to identify configured search peers, allowing fallback to shared local key material. An unauthenticated attacker who obtains the trusted distributed search private key can forge administrative session tokens. This enables access to all relevant data, impacts system integrity, and disrupts availability. The vulnerability is fixed in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14.

An attacker with access to the trusted distributed search private key can impersonate an administrator by forging session tokens. This leads to full data access, potential alteration or corruption of system data, and disruption of service availability. The vulnerability affects confidentiality, integrity, and availability of the Splunk Enterprise system.

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the provided affected version ranges.