In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing… (CVE-2026-76342)

CVE-2026-76342 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user with the "power" role to embed risky SPL commands within a Table Editor dataset. When an admin user opens this dataset, these commands execute with the admin's privileges due to missing SPL safeguards in the Table Editor's field-summary search during the Initial Data step. This can lead to unauthorized data exposure and modification of lookup files. Exploitation requires social engineering to trick an admin user into opening the malicious dataset. The vulnerability stems from improper enforcement of SPL command restrictions in the Table Editor component.

Successful exploitation allows an attacker with a "power" role to cause SPL commands to run with "admin" privileges when an admin user opens a crafted dataset. This can result in exposure of all relevant data accessible to the admin and unauthorized modification of lookup files. The attack requires user interaction (phishing) targeting an admin user. The vulnerability does not allow the "power" role user to exploit it independently without involving the admin user.

No official patch information is provided in the source data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, restrict the assignment of the "power" role to trusted users only and educate admin users to avoid opening untrusted datasets. Review and apply SPL safeguards as recommended by Splunk documentation on risky commands and role capabilities. Monitor Splunk's official channels for updates and patches addressing this issue.