CVE-2026-76290: Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding. The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request. After upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.4 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.8 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.11 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.16 - Configuration
Turn on authentication for Edge Processor package downloads.
Splunk Edge Processor package downloads authentication = enabled - Operational
After upgrading, prepare all existing Edge Processor instances.
- Operational
Restart Splunk Enterprise after preparing the Edge Processor instances and enabling authentication.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11 are affected where the Edge Processor package download endpoint in the Splunk Pipeline Builders app is available. The endpoint accepts package download requests without authentication.
Does an attacker need credentials or user interaction?
No. An unauthenticated remote user can repeatedly request package downloads; no credentials or user interaction are required.
What is the practical impact of repeated requests?
Each request causes the complete package to be read and base64-encoded in memory. Repeated requests can consume excessive system resources and cause the Splunk daemon to stop responding.
What should be done after upgrading?
Prepare all existing Edge Processor instances, enable authentication for Edge Processor package downloads, and restart Splunk Enterprise.