Description
In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope.
The vulnerability is possible because the Data Management Representational State Transfer (REST) API verifies the required capability but does not verify that the requested preview job belongs to the requester.
The affected Data Management REST API is available only when the Edge Processor feature is turned on. The Edge Processor feature is turned off by default.
For more information see Set up a data management control plane (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/getting-started/set-up-a-data-management-control-plane) and Getting sample data for previewing data transformations (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/working-with-pipelines/getting-sample-data-for-previewing-data-transformations) in the Splunk documentation.
Published: 2026-10-21
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized read and deletion of data management preview jobs
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises because the Data Management REST API verifies that a user has the preview_data_management_pipeline or edit_data_management_pipeline_job capability, but it does not confirm that the job being accessed belongs to the requesting user. Consequently, a user with those capabilities can read or delete SPL2 preview jobs and results that are outside their ownership scope, leading to potential confidentiality and integrity compromise of data within the Splunk Enterprise environment.

Affected Systems

Splunk Enterprise systems running versions earlier than 10.4.4, 10.2.8, 10.0.11, or 9.4.16, when the Edge Processor feature is enabled. The Edge Processor feature is disabled by default, so the vulnerability is only active on hosts where it has been turned on.

Risk and Exploitability

The CVSS score of 5.4 reflects a moderate severity. Exploitation requires the Edge Processor feature to be enabled and the attacker to possess the relevant capabilities. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation at this time.

Generated by OpenCVE AI on October 22, 2026 at 04:09 UTC.

Remediation

Vendor Solution

Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.

Vendor Workaround

Turn off the SPL2 preview sidecar by setting `spl2_preview_enabled` to `false` in the `server.conf` configuration file if you do not use SPL2 previews for Edge Processor pipelines. Restart Splunk Enterprise for the change to take effect. For more information see the [server.conf configuration specification file](https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.4/configuration-file-reference/10.4.4-configuration-file-reference/server.conf) in the Splunk documentation.

OpenCVE Recommended Actions

  • Upgrade Splunk Enterprise to at least version 10.4.4, 10.2.8, 10.0.11, or 9.4.16
  • If the SPL2 preview feature is not required, disable it by setting spl2_preview_enabled to false in server.conf and restart Splunk Enterprise
  • Remove the preview_data_management_pipeline and edit_data_management_pipeline_job capabilities from users who do not need them

Generated by OpenCVE AI on October 22, 2026 at 04:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Splunk splunk
CPEs cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
Vendors & Products Splunk splunk

Sun, 25 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
First Time appeared Splunk
Splunk splunk Enterprise
Vendors & Products Splunk
Splunk splunk Enterprise

Wed, 21 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope. The vulnerability is possible because the Data Management Representational State Transfer (REST) API verifies the required capability but does not verify that the requested preview job belongs to the requester. The affected Data Management REST API is available only when the Edge Processor feature is turned on. The Edge Processor feature is turned off by default. For more information see Set up a data management control plane (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/getting-started/set-up-a-data-management-control-plane) and Getting sample data for previewing data transformations (https://help.splunk.com/en/splunk-enterprise/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/working-with-pipelines/getting-sample-data-for-previewing-data-transformations) in the Splunk documentation.
Title Authorization Bypass in the Data Management REST API in Splunk Enterprise
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Splunk Splunk Splunk Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-10-23T15:08:38.358Z

Reserved: 2026-08-19T12:02:03.622Z

Link: CVE-2026-76287

cve-icon Vulnrichment

Updated: 2026-10-23T14:48:05.487Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-21T23:17:26.383

Modified: 2026-10-30T20:49:07.900

Link: CVE-2026-76287

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T05:00:11Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key