CVE-2026-76264: Improper Authorization through the REST API in Splunk Enterprise

Q: Which users can exploit this issue?

Any authenticated Splunk Enterprise user who does not have the admin or power role may be able to exploit it through raw configuration endpoints. The issue requires low-level privileges; it is not described as unauthenticated.

Q: What access path is involved?

The affected path is the REST API raw transforms configuration write functionality. It allows creation or modification of scripted lookup definitions without applying the external lookup capability checks.

Q: Which versions are affected?

The issue affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15.

Published Oct 7, 2026

Updated

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.

Affected Software

5 affected components

Splunk Splunk Enterprise<10.4.2, <10.2.6, <10.0.10, <9.4.15

Splunk splunk>=9.4.0<9.4.15

Splunk splunk>=10.0.0<10.0.10

Splunk splunk>=10.2.0<10.2.6

Splunk splunk>=10.4.0<10.4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.4.3
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.2.7
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.0.10
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 9.4.15
Configuration
Set scripted_lookup_raw_write_enforcement = block in the [lookup] section of limits.conf after upgrading.
Splunk Enterprise scripted_lookup_raw_write_enforcement = block
Operational
Restart Splunk Enterprise after changing limits.conf.

Event History

Oct 7, 2026

CVE Published

via MITRE·08:46 PM

Data Sourced

via MITRE·08:46 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated Splunk Enterprise user who does not have the admin or power role may be able to exploit it through raw configuration endpoints. The issue requires low-level privileges; it is not described as unauthenticated.

What access path is involved?