In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform… (CVE-2026-76313)
Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a vulnerability that allows users without admin or power roles to perform remote code execution by uploading a malicious knowledge bundle. This occurs because the REST API endpoint for knowledge bundle upload does not require the high-privilege capability edit_dist_peer, and distributed search accepts knowledge bundles from less privileged users. This can lead to unauthorized access to data and impact system integrity and availability.
AI Analysis
Technical Summary
CVE-2026-76313 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises from insufficient privilege checks on the REST API endpoint used for uploading knowledge bundles. Users without the admin or power roles can upload malicious knowledge bundles that are then used by distributed search, enabling remote code execution. This flaw stems from the REST API not requiring the edit_dist_peer capability and distributed search accepting user-supplied knowledge bundles without proper privilege validation.
Potential Impact
Successful exploitation allows a user with limited privileges to execute arbitrary code remotely, potentially gaining access to all relevant data and compromising system integrity and availability. This elevates the risk of unauthorized data access and disruption of Splunk Enterprise operations.
Mitigation Recommendations
A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Since this is not a cloud service, patching the affected software versions is required to mitigate the risk.
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform… (CVE-2026-76313)
Description
Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a vulnerability that allows users without admin or power roles to perform remote code execution by uploading a malicious knowledge bundle. This occurs because the REST API endpoint for knowledge bundle upload does not require the high-privilege capability edit_dist_peer, and distributed search accepts knowledge bundles from less privileged users. This can lead to unauthorized access to data and impact system integrity and availability.
CVSS v3.1
Score 8.8high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76313 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises from insufficient privilege checks on the REST API endpoint used for uploading knowledge bundles. Users without the admin or power roles can upload malicious knowledge bundles that are then used by distributed search, enabling remote code execution. This flaw stems from the REST API not requiring the edit_dist_peer capability and distributed search accepting user-supplied knowledge bundles without proper privilege validation.
Potential Impact
Successful exploitation allows a user with limited privileges to execute arbitrary code remotely, potentially gaining access to all relevant data and compromising system integrity and availability. This elevates the risk of unauthorized data access and disruption of Splunk Enterprise operations.
Mitigation Recommendations
A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Since this is not a cloud service, patching the affected software versions is required to mitigate the risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-23wv-2qr9-wf5v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-76313"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a870a90acd9273b49b5a1fe
Added to database: 08/20/2026, 14:09:20 UTC
Last enriched: 08/20/2026, 14:56:18 UTC
Last updated: 08/20/2026, 21:51:58 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.