CVE-2026-76320 Overview
CVE-2026-76320 is a cross-site request forgery (CSRF) vulnerability in Splunk Enterprise affecting the Event Type Builder feature. An unauthenticated attacker can trick an authenticated user into executing arbitrary Search Processing Language (SPL) searches on their behalf. Successful exploitation exposes indexed data and stored credentials accessible to the victim's account.
The flaw exists because the Event Type Builder accepts cross-site request input and retains SPL-affecting values while constructing sample event searches. Exploitation requires the attacker to phish the affected user and trick them into initiating a request within their browser.
Critical Impact
An unauthenticated attacker can execute arbitrary SPL searches under an authenticated user's session, exposing indexed data and stored credentials via CSRF against the Event Type Builder.
Affected Products
- Splunk Enterprise versions below 10.4.2
- Splunk Enterprise versions below 10.2.6
- Splunk Enterprise versions below 10.0.9 and 9.4.14
Discovery Timeline
- 2026-08-19 - CVE-2026-76320 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76320
Vulnerability Analysis
The vulnerability resides in the Splunk Enterprise Event Type Builder, a component that helps administrators automatically find and build event types from sample searches. The builder accepts input from cross-origin requests and preserves values that influence SPL query execution. This behavior allows an attacker-controlled page to construct a request that, when loaded in an authenticated user's browser, causes the Splunk instance to execute attacker-chosen SPL on the victim's behalf.
The CWE classification is [CWE-943] Improper Neutralization of Special Elements in Data Query Logic. Because SPL queries can target any index the victim can read and reference stored credentials in configuration, the impact scales with the privileges of the phished user. An administrator target would expose credentials and sensitive event data across the deployment.
Root Cause
The Event Type Builder does not adequately validate the origin of requests that supply SPL-affecting parameters. Missing anti-CSRF token enforcement on this endpoint allows off-site pages to submit state-changing search construction requests using the victim's session cookies.
Attack Vector
The attack is network-based and requires user interaction. The attacker hosts a malicious page or delivers a phishing link. When the authenticated Splunk user visits the page, the browser issues a forged request to the Event Type Builder endpoint. The endpoint executes the embedded SPL under the victim's identity and returns data the attacker can exfiltrate through downstream mechanisms. Refer to the Splunk Security Advisory SVD-2026-0801 for endpoint-specific technical details.
Detection Methods for CVE-2026-76320
Indicators of Compromise
- Splunk _audit index entries showing SPL searches initiated by authenticated users with Referer headers pointing to external or untrusted domains.
- Unexpected event type creation or modification events tied to interactive user sessions during off-hours.
- Search activity accessing credential stores (passwords.conf lookups, | rest /services/storage/passwords) originating from Event Type Builder workflows.
Detection Strategies
- Hunt for HTTP requests to Event Type Builder endpoints where the Origin or Referer header does not match the deployment's Splunk Web hostname.
- Correlate user-agent, source IP, and search patterns to identify SPL executions inconsistent with the user's normal behavior baseline.
- Alert on searches that enumerate | rest endpoints exposing credentials or configuration shortly after a user visits an external URL.
Monitoring Recommendations
- Enable and forward Splunk Web access logs and audit logs to a centralized analytics platform for cross-source correlation.
- Baseline typical Event Type Builder usage per user and alert on deviations in request volume or SPL complexity.
- Monitor outbound DNS and HTTP traffic from Splunk users' workstations for connections to suspicious domains preceding anomalous SPL activity.
How to Mitigate CVE-2026-76320
Immediate Actions Required
- Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later according to your deployment branch.
- Restrict Splunk Web access to trusted networks and require VPN or zero-trust access controls for administrative users.
- Rotate credentials stored in Splunk configuration if exploitation is suspected, including service accounts referenced in passwords.conf.
Patch Information
Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Review the Splunk Security Advisory SVD-2026-0801 for the full list of fixed builds, download links, and upgrade guidance.
Workarounds
- Train Splunk administrators and power users to avoid clicking unknown links while authenticated to Splunk Web, since exploitation requires user interaction.
- Enforce short session lifetimes for Splunk Web and require re-authentication for privileged actions to reduce the exploitation window.
- Deploy browser isolation or dedicated administrative workstations for users with access to sensitive Splunk indexes and stored credentials.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
