Description
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches from retrieving data from remote datasets.
The vulnerability is possible because the federated provider Representational State Transfer (REST) API accepts GET requests for actions that change provider state.
The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.
For more information see Run federated searches over remote Splunk platform deployments (https://help.splunk.com/en/splunk-enterprise/search/federated-search/10.6/run-federated-searches-across-other-splunk-deployments/run-federated-searches-over-remote-splunk-platform-deployments) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
Published: 2026-10-21
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Disruption of federated search service
Action: Upgrade
AI Analysis

Impact

This vulnerability is a Cross‑Site Request Forgery that allows an attacker to trigger a state change in the Splunk federated search provider configuration by sending a GET request to a REST API endpoint. An attacker cannot act directly; they must phish a user who has the edit_federated_providers capability and convince that user to load a malicious URL. If successful the attacker can disable all federated search providers, causing the system to be unable to retrieve data from remote Splunk indexes until the providers are re‑enabled.

Affected Systems

The flaw exists in Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16. Any installation running one of those legacy releases and assigning the edit_federated_providers capability to a role is potentially vulnerable.

Risk and Exploitability

A CVSS score of 4.2 indicates moderate risk; the exploit requires user interaction and is therefore not automatable. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is CSRF, relying on phishing of a privileged user. While it cannot be exploited by an unauthenticated attacker, the impact of temporarily disabling federated searches could disrupt data correlation and monitoring in production environments.

Generated by OpenCVE AI on October 22, 2026 at 04:02 UTC.

Remediation

Vendor Solution

Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.

OpenCVE Recommended Actions

  • Upgrade Splunk Enterprise to version 10.4.4, 10.2.8, 10.0.11, 9.4.16 or later.
  • Restrict or remove the edit_federated_providers capability from all roles that do not require it to limit the set of users that can trigger the state change.
  • Implement server‑side CSRF protection for the state‑changing REST endpoints, such as requiring POST requests and an anti‑CSRF token.

Generated by OpenCVE AI on October 22, 2026 at 04:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Splunk splunk
CPEs cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
Vendors & Products Splunk splunk

Wed, 28 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Splunk
Splunk splunk Enterprise
Vendors & Products Splunk
Splunk splunk Enterprise

Wed, 21 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches from retrieving data from remote datasets. The vulnerability is possible because the federated provider Representational State Transfer (REST) API accepts GET requests for actions that change provider state. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Run federated searches over remote Splunk platform deployments (https://help.splunk.com/en/splunk-enterprise/search/federated-search/10.6/run-federated-searches-across-other-splunk-deployments/run-federated-searches-over-remote-splunk-platform-deployments) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
Title Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L'}

Subscriptions

Splunk Splunk Splunk Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-10-28T02:03:21.137Z

Reserved: 2026-08-19T12:02:03.622Z

Link: CVE-2026-76297

cve-icon Vulnrichment

Updated: 2026-10-28T02:03:15.603Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-21T23:17:27.690

Modified: 2026-10-30T15:34:32.160

Link: CVE-2026-76297

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T08:30:03Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)