CVE-2026-76323: Splunk Enterprise Auth Bypass Vulnerability

CVE-2026-76323 Overview

CVE-2026-76323 is a Search Processing Language (SPL) safeguard bypass in Splunk Enterprise. A low-privileged user who does not hold the admin or power role can inject SPL through the Job Details dashboard. The Job Details dashboard fails to neutralize a caller-supplied search identifier before placing it into SPL searches [CWE-20].

Exploitation requires phishing an authenticated user into opening a crafted Job Details dashboard link. The injected SPL then executes with the victim's permissions, exposing data and affecting integrity within that user's authorization scope.

Critical Impact
Attackers can execute arbitrary SPL under a victim's session, accessing sensitive indexed data and modifying artifacts the victim can reach.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6 and 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76323 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76323

Vulnerability Analysis

The Job Details dashboard in Splunk Enterprise accepts a search identifier from the URL and uses it to construct SPL queries. The dashboard does not correctly neutralize this caller-supplied value, allowing an attacker to embed additional SPL syntax within the identifier parameter.

When a victim opens the crafted dashboard link, the browser submits the malicious identifier to Splunk. The backend places the value into an SPL search string without sufficient sanitization. The resulting search runs risky SPL commands that would otherwise be blocked by safeguards for non-privileged callers.

The attacker inherits the victim's role and access. If the victim holds broader index or app permissions, the injected SPL reaches those resources. This turns any authenticated Splunk user into a potential delivery target for privileged SPL execution.

Root Cause

The root cause is improper input validation [CWE-20] on the search identifier parameter processed by the Job Details dashboard. The dashboard trusts the parameter and passes it into SPL generation logic that assumes safe input.

Attack Vector

The attack chain begins with a crafted URL pointing at the victim's Splunk Enterprise Job Details dashboard. The URL encodes malicious SPL fragments within the search identifier. The attacker delivers the link through phishing, chat, or embedded content. When the authenticated victim loads the URL, Splunk composes and executes the tampered SPL under the victim's session context.

The vulnerability requires user interaction and existing low-privileged authenticated access. See the Splunk Security Advisory SVD-2026-0801 for advisory details.

Detection Methods for CVE-2026-76323

Indicators of Compromise

Job Details dashboard requests containing SPL metacharacters, pipe symbols, or command keywords inside the search identifier parameter.
Audit log entries showing risky SPL commands (delete, outputlookup, script, sendemail) executed by users who do not hold the admin or power roles.
Search jobs created from Job Details dashboard referrer URLs that include unusually long or encoded identifier values.

Detection Strategies

Parse Splunk _audit and _internal indexes for search strings that originate from Job Details dashboard sessions and contain commands normally restricted to elevated roles.
Correlate web access logs against user role assignments to flag SPL command execution that exceeds the invoking user's expected privilege.
Alert on inbound HTTP referrers to /en-US/manager/*/job endpoints with encoded pipe characters or SPL keywords in query strings.

Monitoring Recommendations

Continuously monitor Splunk audit logs for anomalous SPL patterns tied to non-admin, non-power accounts.
Track phishing telemetry for URLs referencing internal Splunk hostnames and Job Details paths.
Enable alerting on new or unexpected use of risky SPL commands across the environment.

How to Mitigate CVE-2026-76323

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later based on your deployment branch.
Review role assignments and remove unused low-privileged accounts that could be targeted for phishing delivery.
Educate Splunk users about phishing links that reference internal Splunk URLs and Job Details dashboards.

Patch Information

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Refer to the Splunk Security Advisory SVD-2026-0801 for the complete list of fixed builds and upgrade guidance.

Workarounds

Restrict access to the Job Details dashboard through role-based capability controls until patching is complete.
Enforce SSO and multi-factor authentication to raise the cost of session abuse if a phishing link is opened.
Apply network-layer controls that block external referrers from reaching Splunk Web endpoints where feasible.

bash

# Verify Splunk Enterprise version after upgrade
$SPLUNK_HOME/bin/splunk version

# Review recent risky SPL executions by non-privileged users
index=_audit action=search info=granted
| search search="*| delete*" OR search="*| outputlookup*" OR search="*| script*"
| join user [| rest /services/authentication/users | search NOT roles=admin NOT roles=power | fields title | rename title as user]
| table _time user search