CVE-2026-76348 Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege listsearchheadclustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a...

CVE-2026-76345 Remote Code Execution (RCE) through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer REST API to write files to locations that the user account running Splunk Enterprise can writ...

CVE-2026-76345

CVE-2026-76345 is a remote code execution vulnerability in Splunk Enterprise versions below 10.4.2 (also affecting 10.2.x, 10.0.x, and 9.4.x branches). The search head cluster member bundle REST API fails to enforce its expected authorization boundary and does not validate bundle paths before acc...

CVE-2026-76340

Splunk Enterprise 10.4.x versions below 10.4.2 are affected by a missing authorization vulnerability in the REST API . The token-key reload endpoint does not require authentication or the change_authentication capability, allowing an unauthenticated attacker to force a reload of token-signing key...

CVE-2026-76340 Missing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer REST API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability is possible because...

CVE-2026-76322

CVE-2026-76322 is an SPL injection vulnerability in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 ) affecting the Dashboard Studio component. A user holding the "user" role can craft a dashboard that executes attacker-controlled Search Processing Language (SPL) in the conte...

CVE-2026-76322 SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language SPL for another authenticated user. The attacker-controlled SPL could access all releva...

CVE-2026-76263 Improper Access Control through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

CVE-2026-76263

Splunk Enterprise versions below 10.4.2 and 10.2.6 have a broken object-level authorization flaw in the data management orchestrator REST API, allowing low-privilege users to delete SPL2 modules owned by other users. CVSS 5.4 (MEDIUM). Patch to 10.4.2 or 10.2.6; see advisory SVD-2026-0801. No in-...

CVE-2026-76257 Missing Authorization through REST API Endpoints in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access...

CVE-2026-76256

CVE-2026-76256 is an information disclosure vulnerability in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Splunk Secure Gateway (versions below 3.10.9, 3.9.23, 3.8.70). The root cause is that SAML setup and instance settings REST API endpoints do not enforce authorization...

CVE-2026-76257

CVE-2026-76257 is a missing authorization vulnerability in Splunk Enterprise (below 10.4.2, 10.2.6, 10.0.9, 9.4.14) and Splunk Secure Gateway (below 3.10.10, 3.9.24, 3.8.71). The root cause is that REST API endpoints for deployment bundle, SAML setup, and companion app workflows do not enforce Sp...

CVE-2026-76251 Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored fo...

CVE-2026-76251

Splunk Enterprise versions before 10.0.9, 10.2.6, and 10.4.2 fail to enforce the read_o11y_content capability on the Splunk App for Splunk Observability Cloud REST API endpoints, allowing low-privilege users to forward requests using the stored access token, exposing Observability Cloud data (HIG...

CVE-2026-18544

IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references...

CVE-2026-18544

IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references...

CVE-2026-76827 Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

EUVD-2026-63091

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

CVE-2026-76827

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

CVE-2026-46453

A flaw was found in the camel-elasticsearch-rest-client component of Apache Camel. An untrusted HTTP client can exploit this vulnerability by sending specific, unprefixed Exchange headers directly on its request when a Camel route exposes an HTTP entry point. This improper input validation allows...