CVE-2026-76348: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise
CVE-2026-76348 is a low-severity vulnerability in Splunk Enterprise versions 9.4, 10.0, 10.2, and 10.4. It allows users with the high-privilege list_search_head_clustering capability to send read requests to Search Head Cluster member control endpoints and change cluster state without proper authorization checks. This can lead to denial of service conditions. The issue arises because these endpoints do not require a state-changing HTTP request type before applying read-only authorization.
AI Analysis
Technical Summary
In affected versions of Splunk Enterprise, the Search Head Cluster member control endpoints fail to perform proper authorization checks when a user with the list_search_head_clustering capability sends read requests. This allows such users to change the cluster state, potentially causing denial of service. The vulnerability exists because the endpoints do not require a state-changing HTTP request type before applying read-only authorization, enabling unauthorized state changes via read requests.
Potential Impact
An attacker with a Splunk role containing the list_search_head_clustering capability can cause denial of service by changing the cluster state through unauthorized read requests to Search Head Cluster member control endpoints. There is no confidentiality impact, but integrity and availability impacts are present at a low severity level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict roles that include the list_search_head_clustering capability to trusted users only to minimize risk.
CVE-2026-76348: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise
Description
CVE-2026-76348 is a low-severity vulnerability in Splunk Enterprise versions 9.4, 10.0, 10.2, and 10.4. It allows users with the high-privilege list_search_head_clustering capability to send read requests to Search Head Cluster member control endpoints and change cluster state without proper authorization checks. This can lead to denial of service conditions. The issue arises because these endpoints do not require a state-changing HTTP request type before applying read-only authorization.
CVSS v3.1
Score 3.8low
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In affected versions of Splunk Enterprise, the Search Head Cluster member control endpoints fail to perform proper authorization checks when a user with the list_search_head_clustering capability sends read requests. This allows such users to change the cluster state, potentially causing denial of service. The vulnerability exists because the endpoints do not require a state-changing HTTP request type before applying read-only authorization, enabling unauthorized state changes via read requests.
Potential Impact
An attacker with a Splunk role containing the list_search_head_clustering capability can cause denial of service by changing the cluster state through unauthorized read requests to Search Head Cluster member control endpoints. There is no confidentiality impact, but integrity and availability impacts are present at a low severity level.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict roles that include the list_search_head_clustering capability to trusted users only to minimize risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2026-08-19T12:02:03.628Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a862259acd9273b49a6fee9
Added to database: 08/19/2026, 21:38:33 UTC
Last enriched: 08/19/2026, 22:24:34 UTC
Last updated: 08/20/2026, 00:42:22 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.