Splunk Enterprise 10.0.0 < 10.0.10, 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364457);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/12");

  script_cve_id(
    "CVE-2026-76271",
    "CVE-2026-76274",
    "CVE-2026-76267",
    "CVE-2026-76276",
    "CVE-2026-76278"
  );
  script_xref(name:"IAVA", value:"2026-A-1105");

  script_name(english:"Splunk Enterprise 10.0.0 < 10.0.10, 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Splunk Enterprise installed on the remote host is 10.0.x prior to 10.0.10, 10.2.x prior to 10.2.7, or
10.4.x prior to 10.4.3. Splunk Enterprise 9.4.x is not affected. It is, therefore, affected by multiple vulnerabilities
as referenced in the SVD-2026-1001 advisory, including:

  - A low-privileged user could cause a denial of service against a REST API endpoint in the Discover Splunk
    Observability Cloud app, because the app uses an inefficient regular expression to validate input.
    (CVE-2026-76271)

  - A user that holds a role with the read_o11y_content capability could redirect an outbound request from
    Splunk App for Splunk Observability Cloud to an attacker-controlled host and disclose the configured
    Observability Cloud API token. (CVE-2026-76274)

  - A user that holds a role with the read_o11y_content capability could inject forged entries into the Splunk
    App for Splunk O11y Cloud log through the REST API. (CVE-2026-76267)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://advisory.splunk.com/advisories/SVD-2026-1001.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade Splunk Enterprise to version 10.0.10, 10.2.7, 10.4.3, or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-76274");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(117, 407, 639, 918, 1188);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:splunk:splunk");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("splunkd_detect.nasl", "splunk_web_detect.nasl", "macos_splunk_installed.nbin", "splunk_win_installed.nbin", "splunk_nix_installed.nbin");
  script_require_keys("installed_sw/Splunk");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_splunk.inc');

var app_info = vcf::splunk::get_app_info();

var constraints = [
  { 'min_version' : '10.0.0', 'fixed_version' : '10.0.10', 'license' : 'Enterprise' },
  { 'min_version' : '10.2.0', 'fixed_version' : '10.2.7', 'license' : 'Enterprise' },
  { 'min_version' : '10.4.0', 'fixed_version' : '10.4.3', 'license' : 'Enterprise' }
];
vcf::splunk::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);