CVE-2026-76342: Splunk Enterprise Privilege Escalation

CVE-2026-76342 Overview

CVE-2026-76342 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability allows a user with the power Splunk role to store risky Search Processing Language (SPL) commands in a Table Editor dataset. When a user with the admin role opens the shared dataset, the stored SPL commands execute with admin permissions. This authorization flaw is classified under [CWE-863: Incorrect Authorization]. The Table Editor fails to apply SPL safeguards to the field-summary search it runs during the Initial Data step, enabling privilege abuse across role boundaries.

Critical Impact
A lower-privileged power user can trigger SPL commands executed with admin privileges, exposing sensitive data and enabling modification of lookup files through a shared Table Editor dataset.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6
Splunk Enterprise versions below 10.0.9 and 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76342 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76342

Vulnerability Analysis

The vulnerability resides in the Splunk Enterprise Table Editor component. The Table Editor executes a field-summary search during the Initial Data step without enforcing SPL safeguards for risky commands. An attacker with the power role stores malicious SPL commands inside a Table Editor dataset and shares the dataset with an admin role user.

When the admin opens the dataset in the Table Editor, the stored commands execute under the admin's security context. This crosses the trust boundary between the power and admin roles. The commands can read data the admin can access and modify lookup files writable by the admin. Exploitation requires user interaction: the attacker must trick the admin into loading the malicious dataset within their browser session.

Root Cause

The root cause is missing enforcement of SPL safeguards on the field-summary search initiated by the Table Editor. Splunk's SPL safeguards normally block risky commands from executing without explicit administrator authorization. The Table Editor bypasses this control on its Initial Data step, treating stored SPL as trusted regardless of the storing user's role.

Attack Vector

The attack requires three preconditions: the attacker must hold the power role, must share a crafted dataset, and must convince an admin user to open the dataset through phishing or social engineering. The high attack complexity reflects the required user interaction and role prerequisites. The attacker cannot exploit the vulnerability at will because execution depends on admin action within the browser.

The vulnerability is described in prose only; no verified public exploit code is available. See the Splunk Security Advisory SVD-2026-0801 for vendor technical details.

Detection Methods for CVE-2026-76342

Indicators of Compromise

Table Editor datasets created by power role users that contain SPL commands normally classified as risky (for example, delete, outputlookup, script, runshellscript).
Audit log entries showing lookup file modifications initiated by admin accounts shortly after opening a shared dataset.
Field-summary searches invoked from the Table Editor that reference commands outside the standard field-summary pipeline.

Detection Strategies

Review the _audit index for dataset share events followed by admin-context SPL executions of risky commands.
Monitor the history.csv and search job artifacts for commands that were not directly issued by admin users but ran with admin capabilities.
Correlate dataset creation events by power role users with subsequent lookup file writes across the deployment.

Monitoring Recommendations

Enable and centrally forward Splunk internal audit logs to a separate analytics platform for tamper-resistant review.
Alert on any invocation of risky SPL commands originating from Table Editor field-summary searches.
Track role changes and dataset permissions to identify unexpected sharing between power and admin users.

How to Mitigate CVE-2026-76342

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later.
Audit existing Table Editor datasets shared with admin role users and remove any containing risky SPL commands.
Restrict membership of the power role to trusted users and review capabilities assigned to that role.

Patch Information

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Administrators should follow standard upgrade procedures documented by Splunk and validate that SPL safeguards are enforced after the upgrade. Full remediation details are available in the Splunk Security Advisory SVD-2026-0801.

Workarounds

Instruct admin users to avoid opening Table Editor datasets shared by lower-privileged accounts until the upgrade completes.
Remove or restrict the capability to create Table Editor datasets for users holding the power role.
Apply strict browser hygiene: admins should not click Splunk dataset links delivered via email or chat.

bash

# Configuration example: review roles and capabilities via CLI
# List all defined roles
$SPLUNK_HOME/bin/splunk list role

# Inspect capabilities assigned to the power role
$SPLUNK_HOME/bin/splunk show role power

# Remove dataset editing capability from the power role if unnecessary
$SPLUNK_HOME/bin/splunk edit role power -capability -edit_view_html