In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search… (CVE-2026-76345)

In Splunk Enterprise versions prior to 10.4.2, a high-privilege user who can manage search head clustering can abuse the search head cluster member bundle REST API to write arbitrary files to locations writable by the Splunk Enterprise process. This is due to the REST API not enforcing proper authorization boundaries and failing to validate bundle paths before accepting content. Exploitation could enable remote code execution, impacting the confidentiality, integrity, and availability of the Splunk deployment. The vulnerability is identified as CVE-2026-76345 and is rated with a CVSS 3.1 score of 6.0 (medium severity).

Successful exploitation allows remote code execution by writing files to locations accessible by the Splunk Enterprise process. This can lead to unauthorized access to all relevant data and affect the integrity and availability of the affected Splunk deployment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege roles that manage search head clustering to trusted users only. Monitor for unusual activity involving the search head cluster member bundle REST API. Follow Splunk's official documentation on role-based access control to limit exposure.