CVE-2026-76269

Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise

State: Published
Severity: 6.5 Medium
Published: Oct 7, 2026
Updated: Oct 10, 2026
Reserved: Aug 19, 2026

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job metadata, results, and preview results, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully validate job ownership before returning search job information.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	cisco

Weaknesses

CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	10.4 to before 10.4.3Affected 10.2 to before 10.2.7Affected 10.0 to before 10.0.10Affected 9.4 to before 9.4.15Affected

References

https://advisory.splunk.com/advisories/SVD-2026-1001

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.