436562 matches found
CVE-2026-76286
In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it t...
CVE-2026-76278
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the editspl2modulepermissions capability could use the affected Representational State Transfer REST API to access permission grants for SPL2 modules that the user does not have permission to view. The...
CVE-2026-76280
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...
CVE-2026-76273
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the runcollect capability could use the collect Search Processing Language SPL command to add attacker-controlled content to system-level messages on the Splunk platform instance. The...
CVE-2026-76275
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution...
CVE-2026-76274
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...
CVE-2026-76271
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...
CVE-2026-76267
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...
CVE-2026-76270
In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...
CVE-2026-76265
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could...
CVE-2026-76269
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, jo...
CVE-2026-76268
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer REST Application Programming Interface API on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerabili...
CVE-2026-76286
In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it t...
CVE-2026-76286 Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server
In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it t...
CVE-2026-76280 Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...
CVE-2026-76280
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...
CVE-2026-76278
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the editspl2modulepermissions capability could use the affected Representational State Transfer REST API to access permission grants for SPL2 modules that the user does not have permission to view. The...
CVE-2026-76278 Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the editspl2modulepermissions capability could use the affected Representational State Transfer REST API to access permission grants for SPL2 modules that the user does not have permission to view. The...
CVE-2026-76277 Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edituser capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the...
CVE-2026-76275 Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution...