CVE-2026-76345: The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. in Splunk Splunk Enterprise

In Splunk Enterprise versions >=10.4 and <10.4.2, the search head cluster member bundle REST API does not properly enforce authorization boundaries and fails to validate bundle paths before accepting content. This allows a high-privilege user managing search head clustering to write files to locations writable by the Splunk process, potentially enabling remote code execution. The vulnerability is fixed in version 10.4.2. It affects the confidentiality, integrity, and availability of the Splunk deployment.

Successful exploitation could allow an attacker with a high-privilege Splunk role to execute arbitrary code remotely by writing files to the system. This compromises the confidentiality of all relevant data, the integrity of the Splunk deployment, and its availability.

Upgrade Splunk Enterprise to version 10.4.2 or later to remediate this vulnerability. No other mitigation or temporary fix is indicated. Versions below 10.4 are not affected.