CVE-2026-76341: Splunk Enterprise Auth Bypass Vulnerability

CVE-2026-76341 Overview

CVE-2026-76341 is an authorization vulnerability [CWE-863] in Splunk Enterprise that allows a lower-privileged user holding the power role to store attacker-controlled Search Processing Language (SPL) in a Table Editor dataset. When a user with the admin role opens the shared dataset in the Table Editor, the SPL executes under the admin's permissions. This cross-privilege execution can expose all data accessible to the admin and modify a limited set of data on the search head. The flaw affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Exploitation requires social engineering to trick the admin into opening the malicious dataset.

Critical Impact
An attacker with power role privileges can escalate execution to admin context by phishing an administrator into opening a crafted Table Editor dataset, exposing sensitive search head data.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6, 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76341 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76341

Vulnerability Analysis

The vulnerability resides in the Splunk Enterprise Table Editor component. The Table Editor prepares the initial data for a dataset by executing SPL, but it does not enforce the SPL safeguards for risky commands during this preparation stage. A user with the power role can author a Table Editor dataset containing risky SPL commands and share it with other users.

When an admin user opens the shared dataset in the Table Editor, the stored SPL runs under the admin's session context. This produces a confused deputy condition where the admin unwittingly executes SPL authored by a less-privileged user. The impact includes disclosure of any data the admin can query and limited write operations on the search head.

Exploitation requires user interaction. The attacker must phish the admin into opening the malicious dataset within their authenticated browser session. The power role user cannot force execution unilaterally, which raises the attack complexity.

Root Cause

The Table Editor fails to apply SPL safeguards for risky commands [CWE-863] when it constructs the dataset's initial data. Splunk's standard risky-command protections normally block or restrict commands such as delete, outputlookup, or external command invocations, but the Table Editor initialization path bypasses those controls. Combined with the dataset sharing feature, this permits SPL authored by one role to execute in the security context of another.

Attack Vector

An authenticated attacker with the power Splunk role creates a Table Editor dataset with malicious SPL embedded as initial data. The attacker shares the dataset with an admin role user, then delivers a phishing message that induces the admin to open the dataset in the Table Editor within their browser. On open, the stored SPL executes with admin privileges against the search head.

Refer to the Splunk Security Advisory SVD-2026-0801 for vendor-provided technical details.

Detection Methods for CVE-2026-76341

Indicators of Compromise

Table Editor datasets created by power role users that contain risky SPL commands such as delete, outputlookup, script, or sendemail in the initial data definition.
Audit log entries in _audit showing SPL execution under an admin account originating from a dataset owned by a non-admin user.
Unexpected sharing events on Table Editor datasets from power role accounts to admin role accounts.

Detection Strategies

Query index=_audit action=search info=granted and correlate the dataset owner role against the executing user role to identify cross-role SPL execution.
Inventory all Table Editor datasets and inspect the search and initialdata fields for risky commands defined by non-admin owners.
Alert on Splunk Web activity where an admin account opens a Table Editor dataset owned by a power role account shortly after receiving external email or chat links.

Monitoring Recommendations

Continuously monitor Splunk internal indexes (_audit, _internal) for SPL execution patterns that deviate from an admin's baseline query behavior.
Track configuration changes to datamodels.conf and Table Editor knowledge objects across the search head cluster.
Enable alerting on privileged administrator sessions that execute risky SPL commands originating from shared knowledge objects.

How to Mitigate CVE-2026-76341

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later, as appropriate for your deployment branch.
Audit existing Table Editor datasets owned by power role users and remove or quarantine any that contain risky SPL commands.
Review the assignment of the power role and remove it from any accounts that do not require it.

Patch Information

Splunk has released fixed versions in the 10.4.2, 10.2.6, 10.0.9, and 9.4.14 release branches. Consult the Splunk Security Advisory SVD-2026-0801 for the complete list of patched builds and upgrade instructions.

Workarounds

Restrict the power role capabilities so that affected users cannot create or share Table Editor datasets until the patch is applied.
Train administrators to avoid opening Table Editor datasets shared by non-admin users, and to verify dataset ownership before opening.
Enforce SPL safeguards for risky commands at the deployment level and confirm they apply to all Table Editor code paths after upgrade.

bash

# Verify installed Splunk Enterprise version prior to and after patching
$SPLUNK_HOME/bin/splunk version

# List Table Editor datasets and their owners for audit
$SPLUNK_HOME/bin/splunk search '| rest /servicesNS/-/-/datamodel/model | search eai:acl.owner!=admin | table title eai:acl.owner eai:acl.sharing search'