Threats Tagged 'cve-2026-76338'

Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise, specifiek in versies vóór 10.4.2, 10.2.6, 10.0.9 en 9.4.14.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material. For more information see About distributed search (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-distributed-search/about-distributed-search) and authentication.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/authentication.conf) in Splunk documentation.

CVE-2026-76338 is a high-severity vulnerability in Splunk Enterprise affecting versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an unauthenticated attacker with access to a trusted distributed search private key to forge an administrative session token. This flaw arises because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, falling back to shared local key material. Exploitation can lead to unauthorized data access, system integrity compromise, and service disruption.