CVE-2026-76338 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. An unauthenticated attacker who has access to a trusted distributed search private key can exploit the lack of signed request enforcement at the distributed search authentication token endpoint. This enables forging of administrative session tokens, granting full access to relevant data, the ability to affect system integrity, and disrupt availability. The vulnerability stems from the endpoint's fallback to shared local key material when identifying configured search peers without requiring signed requests.

Successful exploitation allows an unauthenticated attacker with access to the trusted distributed search private key to impersonate an administrator, access all relevant data, compromise system integrity, and disrupt service availability. This represents a high-severity risk to confidentiality, integrity, and availability of affected Splunk Enterprise deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to distributed search private keys to trusted personnel only and monitor for unauthorized access attempts. Review Splunk documentation on distributed search and authentication configuration to understand and potentially harden authentication token handling.