CVE-2026-76348: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the Search Head Cluster member control endpoints lack proper authorization checks when processing read requests from users with the list_search_head_clustering capability. This flaw allows such users to alter cluster state, potentially causing denial of service. The vulnerability is due to the endpoints not enforcing a state-changing HTTP request type before applying read-only authorization, enabling unauthorized state changes via read requests.

An attacker with a Splunk role containing the list_search_head_clustering capability can cause denial of service by changing the cluster state through unauthorized read requests to Search Head Cluster member control endpoints. There is no impact on confidentiality, but integrity and availability are affected.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation guidance is provided.