CVE-2026-76348: Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege listsearchheadclustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a denial of service. The vulnerability is possible because the Search Head Cluster member control endpoints do not require a state-changing Hypertext Transfer Protocol (HTTP) request type before they apply read-only authorization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
splunk-enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
splunk-enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
splunk-enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
splunk-enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user must hold a Splunk role containing the high-privilege list_search_head_clustering capability. The issue affects Search Head Cluster member control endpoints.
What is the practical impact?
A qualifying user can send a read request to member control endpoints that changes cluster state. This can result in a denial of service.
Are all Splunk Enterprise versions affected?
Affected versions are those below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Versions at or above the applicable listed release are not identified as affected.
What can be done before updating?
Restrict the list_search_head_clustering capability to only users who require it. Because exploitation requires that capability, reducing access to it limits exposure.