Description
In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer (REST) API to write files to locations that the user account running Splunk Enterprise can write to, which could allow for remote code execution. Successful exploitation could result in access to all relevant data and could affect the integrity and availability of the Splunk deployment. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because the search head cluster member bundle REST API does not enforce the expected authorization boundary and does not validate bundle paths before accepting bundle content. For more information see Using the REST API reference (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.2/introduction/using-the-rest-api-reference), About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), and About distributed search (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/overview-of-distributed-search/about-distributed-search) in the Splunk documentation.
Published: 2026-08-19
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A high‑privilege user who can manage a search head cluster can use the cluster member bundle REST API to drop files on any location writable by the Splunk Enterprise process. The API does not enforce the proper authorization boundary or validate the bundle path, enabling arbitrary file write that can lead to remote code execution. This weakness corresponds to CWE-284: Improper Access Control. Successful exploitation would give the attacker full access to all data in the deployment and could compromise the integrity and availability of the system.

Affected Systems

The vulnerability affects Splunk Enterprise versions below 10.4.2, including earlier 10.2.x and 10.0.x releases and 9.4.x prior to 9.4.14. Splunk Enterprise is the affected product, and the issue does not apply to releases 10.4.2 or newer.

Risk and Exploitability

The CVSS score of 6.0 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the REST API, requiring a user with a high‑privilege role that manages the search head cluster. If an attacker obtains such credentials, they can exploit the API to write files and trigger code execution, though the exploit requires the ability to access the Splunk API endpoints and privileges to perform file writes.

Generated by OpenCVE AI on August 20, 2026 at 10:49 UTC.

Remediation

Vendor Solution

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.

OpenCVE Recommended Actions

  • Upgrade Splunk Enterprise to the latest supported releases—10.4.2 or newer, 10.2.6 or newer, 10.0.9 or newer, and 9.4.14 or newer, as provided by the vendor.
  • Review and tighten role‑based access controls so that only the minimum necessary roles can manage search head clustering and use the bundle API; remove high‑privilege roles from that scope if possible.
  • Monitor Splunk logs for anomalous file write or REST API activity that could indicate exploitation attempts and investigate any suspicious events.

Generated by OpenCVE AI on August 20, 2026 at 10:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Splunk splunk
CPEs cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
Vendors & Products Splunk splunk

Wed, 19 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Splunk
Splunk splunk Enterprise
Vendors & Products Splunk
Splunk splunk Enterprise

Wed, 19 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer (REST) API to write files to locations that the user account running Splunk Enterprise can write to, which could allow for remote code execution. Successful exploitation could result in access to all relevant data and could affect the integrity and availability of the Splunk deployment. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because the search head cluster member bundle REST API does not enforce the expected authorization boundary and does not validate bundle paths before accepting bundle content. For more information see Using the REST API reference (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.2/introduction/using-the-rest-api-reference), About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), and About distributed search (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/overview-of-distributed-search/about-distributed-search) in the Splunk documentation.
Title Remote Code Execution (RCE) through the REST API in Splunk Enterprise
Weaknesses CWE-284
References
Metrics cvssV3_1

{'score': 6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L'}

Subscriptions

Splunk Splunk Splunk Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-08-20T16:27:36.514Z

Reserved: 2026-08-19T12:02:03.628Z

Link: CVE-2026-76345

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-19T22:17:19.297

Modified: 2026-08-21T19:09:24.717

Link: CVE-2026-76345

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T11:00:04Z

Weaknesses