CVE-2026-76310 Overview
CVE-2026-76310 is a broken access control vulnerability [CWE-284] in Splunk Enterprise. An unauthenticated user holding an embedded report token can download the associated search job dispatch archive through the Representational State Transfer (REST) API. The archive contains session material that attackers can reuse to impersonate the report owner. When the owner holds the admin Splunk role, this leads to full administrative access and integrity impact across the platform. Embedded report access does not block dispatch archive download requests, which is the core defect. Splunk addressed the flaw in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
Critical Impact
Unauthenticated attackers with an embedded report token can recover session material and act as the report owner, including performing administrative actions when the owner has the admin role.
Affected Products
- Splunk Enterprise versions below 10.4.2
- Splunk Enterprise versions below 10.2.6 and 10.0.9
- Splunk Enterprise versions below 9.4.14
Discovery Timeline
- 2026-08-19 - CVE-2026-76310 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76310
Vulnerability Analysis
Splunk Enterprise supports embedded reports, which allow report owners to share results externally using a signed embed token. The embed token is intended to grant read-only visibility to a specific rendered report. The vulnerability arises because the embedded report authorization path does not restrict access to REST API endpoints that serve the underlying search job dispatch archive.
An attacker who obtains an embed token can call the dispatch archive download endpoint and retrieve session material tied to the report owner. That material can be replayed against the Splunk REST API to authenticate as the owner. If the owner holds the admin role, the attacker inherits administrative privileges, including configuration changes and access to all indexed data available to that account.
Root Cause
The root cause is improper access control [CWE-284] on dispatch archive REST endpoints. Embedded report token validation authorizes rendering but does not enforce the same restriction on job artifact downloads. This inconsistency lets the token act as a broader credential than intended.
Attack Vector
The attack is network-based and requires no user interaction. The attacker needs a valid embedded report token, which is often exposed in URLs, page source, browser history, or logs. Once the token is captured, the attacker issues a direct REST API request for the dispatch archive and extracts the session material contained inside.
Refer to the Splunk Security Advisory SVD-2026-0801 for vendor technical details.
Detection Methods for CVE-2026-76310
Indicators of Compromise
- Unexpected REST API calls to search job dispatch archive endpoints originating from clients that only presented an embedded report token.
- Downloads of dispatch archive artifacts followed by REST API activity authenticated as the report owner from a different source IP.
- Administrative configuration changes performed by accounts that typically only run scheduled reports.
Detection Strategies
- Correlate embedded report token usage with subsequent REST API calls to services/search/jobs/<sid>/results or dispatch archive paths.
- Flag session reuse where the same session identifier appears from multiple network locations within a short window.
- Baseline normal embedded report consumers and alert on deviations such as archive downloads or admin endpoint access.
Monitoring Recommendations
- Enable Splunk audit logging for REST API calls and forward _audit and _internal indexes to a centralized analytics platform.
- Monitor for privileged actions performed shortly after embedded report requests from external networks.
- Alert on any download of dispatch archives by clients that did not authenticate with a full user session.
How to Mitigate CVE-2026-76310
Immediate Actions Required
- Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later as documented in SVD-2026-0801.
- Rotate embedded report tokens after patching to invalidate any tokens that may have been captured.
- Review the roles assigned to accounts that own embedded reports and remove admin where not required.
Patch Information
Splunk has released fixed builds in Splunk Enterprise 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The patch enforces access control on dispatch archive REST endpoints so that embedded report tokens cannot authorize job artifact downloads. Details are published in the Splunk Security Advisory SVD-2026-0801.
Workarounds
- Disable embedded reports until the environment is upgraded, following the Additional configuration for embedded reports guidance.
- Restrict ownership of embedded reports to least-privilege accounts, following About configuring role-based user access.
- Place Splunk Web behind a reverse proxy that blocks REST API paths for requests presenting only an embed token.
# Configuration example: disable embedded reports globally
# In $SPLUNK_HOME/etc/system/local/web.conf
[settings]
enableSplunkWebSSL = true
embed_uri =
embed_footer =
# Restart Splunk to apply
$SPLUNK_HOME/bin/splunk restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
