CVE-2026-76312: Improper Access Control through Embedded Reports in Splunk Enterprise
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-report authorization boundary and includes sensitive session material in archived search-job data. For more information see Additional configuration for embedded reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/additional-configuration-for-embedded-reports) and Embed scheduled reports (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/10.4/report-management/embed-scheduled-reports) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.4.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.2.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.4.14
Event History
Frequently Asked Questions
Which deployments are exposed?
Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14 are affected when a page embeds a Splunk report and an unauthenticated user can read that page's HTML source.
What does an attacker need to exploit this issue?
The attacker does not need authentication or user interaction. They need access to the HTML source of a page embedding a Splunk report, from which exposed session material can be used against the dispatch archive download path.
What could an attacker gain?
An attacker could access all relevant data available through the exposed session material and affect system integrity. The stated impact also includes limited availability impact.
How can I determine whether my environment is affected?
Check whether the Splunk Enterprise version is below a listed fixed release and whether scheduled reports are embedded in pages whose HTML source is readable by unauthenticated users. Review embedded-report configurations and the use of dispatch archive downloads.