CVE-2026-76341: The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. in Splunk Splunk Enterprise

The vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 involves improper authorization checks related to the execution of Search Processing Language (SPL) in Table Editor datasets. A user with the "power" role can insert attacker-controlled SPL into a dataset and share it. When an admin user opens this dataset, the SPL executes with the admin's permissions, potentially exposing sensitive data and allowing limited data modification on the search head. This occurs because the Table Editor does not enforce SPL safeguards for risky commands during initial data preparation. Exploitation requires social engineering (phishing) to induce the admin user to open the malicious dataset in their browser.

Successful exploitation can lead to unauthorized disclosure of sensitive data accessible to the admin user and limited unauthorized modification of data on the search head. The attacker must first compromise a user with the "power" role to create the malicious dataset and then trick an admin user into opening it. The vulnerability does not allow the "power" role user to exploit it without involving the admin user. There is no indication of denial of service or system takeover. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, high complexity, low privileges required, user interaction needed, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, organizations should limit the assignment of the "power" role and educate admin users to avoid opening untrusted datasets. The vendor documentation provides guidance on SPL safeguards for risky commands and role definitions to reduce risk. No indication exists that the vulnerability is mitigated by default or requires no action.