CVE-2026-76276 affects Splunk Enterprise versions prior to 10.4.3, 10.2.7, and 10.0.10. A low-privileged user without admin or power roles can access original source code of the Discover Splunk Observability Cloud app via Splunk Web due to embedded source maps in JavaScript bundles. This vulnerability does not affect version 9.4.x. The CVSS score is 4.3, indicating medium severity.
CVE-2026-76275 is a medium severity vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. It allows users without admin or power roles to access search query text and job metadata belonging to other users via a REST API due to insufficient authorization checks. This exposure includes job identifiers, dispatch parameters, result counts, and execution metadata.
CVE-2026-76274 is a vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, and 10.0.10. It allows a user with the read_o11y_content capability to redirect outbound REST API requests from the Splunk App for Splunk Observability Cloud to an attacker-controlled host, potentially exposing the configured Observability Cloud API token. This occurs because the app does not fully validate the destination of outbound requests. Splunk Enterprise 9.4.x versions are not affected.
CVE-2026-76273 is a medium severity vulnerability in Splunk Enterprise that affects versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. It allows a user with the run_collect capability to use the collect SPL command to insert attacker-controlled content into system-level messages due to improper validation of the index name. This could affect the control or data flow within the Splunk platform instance.
CVE-2026-76272 affects Splunk Enterprise and Splunk Secure Gateway where authorization checks are missing for certain actions. Users without admin or power roles can cause Splunk Secure Gateway to sign attacker-controlled payloads due to lack of verification. This vulnerability affects multiple versions of Splunk Enterprise below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, as well as Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72. The CVSS score is 4.3, indicating a medium severity impact. No known exploits are reported in the wild. The vulnerability allows integrity impact but no confidentiality or availability impact.
CVE-2026-76271 is a denial of service vulnerability in Splunk Enterprise versions 10.0.0 through 10.0.9, 10.2.0 through 10.2.6, and 10.4.0 through 10.4.2. It affects a REST API endpoint in the Discover Splunk Observability Cloud app, where an inefficient regular expression used for input validation can be exploited by a low-privileged user without admin or power roles. This causes excessive computational load, leading to denial of service. Versions 9.4.x are not affected.
CVE-2026-76270 is a SQL injection vulnerability in Splunk Enterprise versions 10.4.0 through 10.4.2. It affects users with the list_spl2_modules capability, allowing them to exploit improper input handling in SPL2 module filtering to access sensitive data via the REST API, including private module definitions of other users. Versions 10.2.x, 10.0.x, and 9.4.x are not affected.
CVE-2026-76269 is a vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15 that allows non-admin and non-power users to access other users' search job information via a REST API. This occurs because the API does not properly validate job ownership before returning data. The exposed information includes search query text, job metadata, results, and preview results. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-76268 is a critical vulnerability in Splunk Enterprise versions 10.2.x prior to 10.2.7 and 10.4.x prior to 10.4.3. It allows unauthenticated network users to execute arbitrary operating system commands via the Patroni REST API on search head cluster members, due to lack of authentication on critical configuration operations. Versions 10.0.x and 9.4.x are not affected.
CVE-2026-76267 is a vulnerability in Splunk Enterprise that affects versions prior to 10.4.3, 10.2.7, and 10.0.10. It allows users with the read_o11y_content capability to inject forged log entries via the REST API because the Splunk App for Splunk O11y Cloud does not properly neutralize user-supplied SignalFlow content before logging. Versions 9.4.x are not affected.
CVE-2026-76266 is a privilege escalation vulnerability in Splunk Enterprise on Linux. It affects versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15. A local user with the ability to run commands as the Splunk Enterprise user can manipulate the installation content. When a Linux package upgrade is performed, this can lead to execution of attacker-controlled commands with root privileges. The vulnerability arises because the package maintainer script trusts existing installation content during upgrades. Exploitation requires a package upgrade after the local user modifies the installation. This vulnerability allows unauthorized privilege escalation from a local user with limited privileges to root.
CVE-2026-76265 is a medium severity vulnerability in Splunk Enterprise and Splunk Secure Gateway where users without admin or power roles can access privileged functionality. This occurs because certain REST API endpoints in Splunk Secure Gateway do not properly enforce authorization checks. Exploiting this, an unauthorized user could cause the gateway to sign attacker-controlled payloads. The issue affects multiple versions of Splunk Enterprise below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, as well as Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72.
CVE-2026-76264 is a medium severity vulnerability in Splunk Enterprise that allows users without admin or power roles to create or edit scripted lookup definitions via raw configuration endpoints. This occurs because the software does not correctly enforce external lookup capability checks on raw transforms configuration write paths. The flaw affects specific versions prior to 10.4.2, 10.2.6, 10.0.10, and 9.4.15.
A vulnerability in Splunk On-Call (VictorOps) app versions before 1.0.43 allows users without admin or power roles to read a partially masked API key stored in the App Key Value Store. The API key is not fully masked before storage, exposing sensitive information to unauthorized users with read access to the KV Store.
CVE-2026-76404 is a critical vulnerability in the Splunk MCP Server app affecting versions 1.2 and all versions from 1.2 up to but not including 1.2.1. It allows a user with the admin Splunk role to execute arbitrary commands on the underlying operating system due to insecure deserialization of untrusted data in the credential management component.
CVE-2026-76403 is a vulnerability in Splunk Connect for Kafka versions 2.2 and from 2.2 up to but not including 2.2.7. It involves improper or missing validation of certificates when Kerberos authentication is used with the HTTP Event Collector in Splunk Enterprise. This flaw allows an unauthenticated attacker positioned in the network path to read or modify all relevant data sent from the connector. The issue arises because the Kerberos authentication path does not apply the configured certificate validation options when constructing the HTTP client.
CVE-2026-76402 affects Splunk Connect for Kafka versions 2.2 and all versions from 2.2 up to but not including 2.2.7. An unauthenticated attacker with access to the Kafka Connect REST API can configure a non-secure HTTP Event Collector endpoint in Splunk Enterprise. This misconfiguration causes the connector to send authentication credentials to an attacker-controlled server, exposing credentials and allowing limited alteration of event delivery. The vulnerability arises because the HTTP Event Collector endpoint validation does not require secure transport by default.
CVE-2026-76401 is a medium severity vulnerability in Splunk Connect for Kafka versions 2.2 and from 2.2 up to but not including 2.2.7. An unauthenticated attacker who can access the Kafka Connect REST API can exploit this by configuring timestamp extraction with a crafted regular expression that causes inefficient processing. This leads to blocking of a Kafka Connect worker thread and stops event delivery for the affected connector. The root cause is that timestamp extraction evaluates user-supplied regular expressions without a time limit, allowing the worst-case computational complexity to be triggered.
CVE-2026-76400 is a medium severity vulnerability in Splunk Connect for Kafka versions 2.2 and from 2.2 up to but not including 2.2.7. It allows an unauthenticated user who can access the Kafka Connect REST API and influence HTTP Event Collector responses to cause the connector to retry failed event batches indefinitely. This unbounded retry behavior can exhaust system resources, leading to denial of service conditions.
CVE-2026-76399 is a high-severity vulnerability in Splunk AI Toolkit versions 6.0 and 6.0.0, where users with the "power" Splunk role can modify scheduled searches provided by the app to execute arbitrary Search Processing Language (SPL) queries with the permissions of the search owner. This flaw allows unauthorized access to sensitive data and can compromise system integrity.