CVE-2026-76342: The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. in Splunk Splunk Enterprise

Splunk Enterprise versions before 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain an authorization bypass vulnerability (CVE-2026-76342) where a user with the "power" role can store risky SPL commands in a Table Editor dataset. When an admin user opens this dataset, the commands execute with the admin's privileges due to missing SPL safeguards in the Table Editor's field-summary search during the Initial Data step. This can lead to unauthorized data exposure and modification of lookup files. Exploitation requires social engineering to have an admin user open the crafted dataset.

An attacker with the "power" role can cause an admin user to execute arbitrary SPL commands with admin privileges, potentially exposing sensitive data and modifying lookup files. This could lead to unauthorized data access and integrity issues within Splunk Enterprise. However, exploitation requires phishing the admin user, and the "power" role user cannot exploit this vulnerability without such social engineering.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these versions or later to remediate the vulnerability. Until patched, organizations should carefully control which users have the "power" and "admin" roles and educate users to avoid phishing attempts that could trigger this vulnerability.