Splunk Enterprise 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364456);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id("CVE-2026-76268");
  script_xref(name:"IAVA", value:"2026-A-1105");

  script_name(english:"Splunk Enterprise 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Splunk Enterprise installed on the remote host is 10.2.x prior to 10.2.7 or 10.4.x prior to 10.4.3.
Splunk Enterprise 9.4.x and 10.0.x are not affected. It is, therefore, affected by a missing authentication
vulnerability as referenced in the SVD-2026-1001 advisory. An unauthenticated user with network access to the Patroni
REST API on a search head cluster member could execute attacker-controlled operating system commands, because this
interface does not require authentication for critical configuration operations. (CVE-2026-76268)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://advisory.splunk.com/advisories/SVD-2026-1001.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade Splunk Enterprise to version 10.2.7, 10.4.3, or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76268");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(306);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:splunk:splunk");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("splunkd_detect.nasl", "splunk_web_detect.nasl", "macos_splunk_installed.nbin", "splunk_win_installed.nbin", "splunk_nix_installed.nbin");
  script_require_keys("installed_sw/Splunk");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_splunk.inc');

var app_info = vcf::splunk::get_app_info();

var constraints = [
  { 'min_version' : '10.2.0', 'fixed_version' : '10.2.7', 'license' : 'Enterprise' },
  { 'min_version' : '10.4.0', 'fixed_version' : '10.4.3', 'license' : 'Enterprise' }
];
vcf::splunk::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);