CVE-2026-76350: Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges, expose all relevant data, and affect system integrity and availability on the search head. The vulnerability is possible because the search scheduler passes a system-level authentication context rather than the action owner context to the email alert action when it renders PDF attachments. For more information see alertactions.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/alertactions.conf) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.4.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.2.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.4.14
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A user with a role that includes the schedule_search capability can exploit it by configuring PDF attachments in the email alert action workflow.
What access and conditions are required for exploitation?
The attacker needs an account with the schedule_search capability and must be able to configure a PDF attachment for an email alert action. No user interaction is required once the email alert action runs.
What is the impact on an affected search head?
Arbitrary SPL commands can run with system-level privileges, potentially exposing relevant data and affecting the search head's integrity and availability.
Which Splunk Enterprise versions are affected?
Affected versions are earlier than 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
What configuration should be reviewed while patching is pending?
Review roles assigned the schedule_search capability and inspect email alert actions configured to generate PDF attachments. Restricting that capability and removing or disabling PDF attachment configurations reduces the described exposure.