CVE-2026-76312: Splunk Enterprise Auth Bypass Vulnerability

CVE-2026-76312 Overview

CVE-2026-76312 is a broken access control vulnerability in Splunk Enterprise affecting the dispatch archive download path. The flaw allows an unauthenticated attacker who can read the Hypertext Markup Language (HTML) source of a page embedding a Splunk report to extract exposed session material. That session material grants access to relevant data and enables integrity impact on the Splunk instance. The vulnerability exists because the dispatch archive download path does not enforce the embedded-report authorization boundary and includes sensitive session material in archived search-job data. Splunk addressed the issue in versions 10.4.1, 10.2.6, 10.0.9, and 9.4.14.

Critical Impact
Unauthenticated attackers can harvest session material from embedded report pages to access sensitive search data and modify system state in Splunk Enterprise deployments.

Affected Products

Splunk Enterprise versions below 10.4.1
Splunk Enterprise versions below 10.2.6 and 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76312 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76312

Vulnerability Analysis

The vulnerability resides in the dispatch archive download path used by Splunk Enterprise to serve archived search-job data associated with embedded reports. When a page embeds a Splunk report, session material is written into the archive and rendered accessible through the HTML source. An attacker who reads that HTML source recovers the session material without authenticating to Splunk. The classification [CWE-284] Improper Access Control describes the underlying failure, as the server does not distinguish between an authorized embedded-report context and direct dispatch archive access.

Root Cause

The dispatch archive download path fails to enforce the authorization boundary that separates embedded-report consumers from privileged search-job artifacts. Splunk includes sensitive session material inside archived search-job data returned by that path. As a result, any client that can view the embedding page inherits access to session tokens intended only for the report renderer.

Attack Vector

An unauthenticated attacker locates a page that embeds a Splunk report and inspects the HTML source. The attacker extracts the exposed session material and replays it against the Splunk Enterprise dispatch endpoint. With the reused session material, the attacker reads search results and issues actions that affect system integrity. Network reachability to the Splunk instance is the only prerequisite, and no user interaction with the victim is required.

No verified public proof-of-concept code is available. For technical detail, review the Splunk Security Advisory SVD-2026-0801.

Detection Methods for CVE-2026-76312

Indicators of Compromise

Unauthenticated HTTP requests to the dispatch archive download path referencing search-job identifiers tied to embedded reports.
Repeated access to identical sid (search identifier) values from disparate source IP addresses within short intervals.
Splunk audit.log entries showing search-job retrievals without a preceding authenticated login event.

Detection Strategies

Correlate web access logs from reverse proxies fronting Splunk with Splunk internal audit events to flag dispatch archive requests lacking a valid authenticated session origin.
Alert on anomalous download volume of archived search jobs, especially from IPs that never authenticate to /en-US/account/login.
Baseline the set of embedding origins and flag report retrievals originating from unknown referrers.

Monitoring Recommendations

Enable Splunk _internal audit indexing and forward events to a centralized analytics platform for retention and correlation.
Monitor outbound requests to Splunk dispatch endpoints from perimeter web application firewalls (WAF).
Track version drift across Splunk Enterprise nodes to confirm all instances receive the patched release.

How to Mitigate CVE-2026-76312

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.1, 10.2.6, 10.0.9, or 9.4.14 as appropriate for the deployed branch.
Inventory all internal and external pages that embed Splunk reports and treat them as sensitive until patched.
Rotate session keys and invalidate outstanding search-job artifacts after patching.

Patch Information

Splunk released fixed versions 10.4.1, 10.2.6, 10.0.9, and 9.4.14. Consult the Splunk Security Advisory SVD-2026-0801 for full remediation guidance and version mapping.

Workarounds

Disable embedded report functionality until the patched version is deployed, following guidance in the Splunk documentation for embedded reports.
Restrict network access to the Splunk management interface using firewall rules or network segmentation.
Place a reverse proxy in front of Splunk to require authentication on the dispatch archive download path.

bash

# Configuration example: restrict access to the dispatch archive path at the reverse proxy
location ~* /services/search/jobs/.*/results {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass https://splunk-backend:8000;
}