CVE-2026-76275: Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution metadata, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully enforce per-user authorization before it includes job information in search job listings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.3 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.7 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.10 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.15
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated Splunk Enterprise user who does not have the admin or power role may be able to access search job information belonging to other users through the REST API. Exploitation requires only low-level authenticated access; no user interaction is required.
What information could be exposed?
Affected search job listings can disclose other users' search query text and job metadata, including job identifiers, dispatch parameters, result counts, and execution metadata. The provided data describes an information disclosure impact, not modification or service disruption.
Which versions should be remediated?
Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 are affected. Update to the applicable listed version or later.
How can an organization determine whether it may be affected?
Review the installed Splunk Enterprise version and determine whether it is below the applicable fixed release. Also review whether non-admin, non-power users can access REST API search-job listings and see jobs owned by other users.