CVE-2026-76345: Splunk Enterprise RCE Vulnerability

CVE-2026-76345 Overview

CVE-2026-76345 affects Splunk Enterprise versions below 10.4.2. The vulnerability exists in the search head cluster member bundle Representational State Transfer (REST) API. A user holding a high-privilege Splunk role that manages search head clustering can write files to any location writable by the Splunk service account. This file-write primitive can lead to remote code execution on the affected instance. Successful exploitation grants access to all indexed data and impacts the integrity and availability of the Splunk deployment. Versions of Splunk Enterprise below 10.4 are not affected by this issue.

Critical Impact
Authenticated attackers with search head cluster management privileges can achieve arbitrary file write leading to remote code execution and full data compromise.

Affected Products

Splunk Enterprise 10.4.0
Splunk Enterprise 10.4.1
Splunk Enterprise versions below 10.4.2 (10.4 branch only)

Discovery Timeline

2026-08-19 - CVE-2026-76345 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76345

Vulnerability Analysis

The vulnerability is classified under [CWE-284] Improper Access Control. The search head cluster member bundle REST API fails to enforce the expected authorization boundary. It also does not validate bundle paths before accepting bundle content submitted by clients. An authenticated user with a high-privilege role that can manage search head clustering can therefore submit bundle content directed at arbitrary paths. The Splunk service writes those files under its own account privileges, which typically include write access to configuration and executable content used by the Splunk runtime. Writing to such locations enables code execution on the search head. The attack is network-reachable because the REST API is exposed over the Splunk management port.

Root Cause

Two defects combine to produce the vulnerability. First, the bundle REST endpoint does not check whether the caller is authorized to write bundle content to the target member. Second, the endpoint accepts bundle path values without validating that they resolve within the expected bundle directory. Together these gaps allow path traversal and unauthorized cross-member writes.

Attack Vector

An attacker authenticates to Splunk Enterprise using an account with a high-privilege role that can manage search head clustering. The attacker then issues crafted requests to the search head cluster member bundle REST API. Requests specify bundle paths outside the intended directory and include attacker-controlled file content. The Splunk process writes the supplied content to the attacker-chosen path. The attacker then triggers execution of the written content through normal Splunk load paths.

No verified proof-of-concept code has been published. Refer to the Splunk Security Advisory SVD-2026-0801 for vendor technical details.

Detection Methods for CVE-2026-76345

Indicators of Compromise

Unexpected POST or PUT requests to search head cluster member bundle REST endpoints from accounts that do not normally administer clustering
New or modified files under $SPLUNK_HOME/etc/ written outside standard bundle replication windows
Bundle path parameters containing ../ sequences or absolute paths in Splunk splunkd_access.log entries
Splunk child processes spawning shells, interpreters, or network utilities inconsistent with baseline behavior

Detection Strategies

Audit Splunk audit.log and splunkd_access.log for calls to search head cluster bundle REST endpoints and correlate with the role of the calling user
Alert on file creation events under Splunk installation directories that do not originate from the standard bundle replication workflow
Monitor process ancestry to identify splunkd spawning unexpected child processes on search head cluster members

Monitoring Recommendations

Forward Splunk internal logs (_internal index) to an independent monitoring pipeline to prevent an attacker from tampering with evidence on the compromised host
Baseline which accounts legitimately manage search head clustering and alert on any deviation
Track integrity of $SPLUNK_HOME/etc/apps and $SPLUNK_HOME/etc/system directories with file integrity monitoring

How to Mitigate CVE-2026-76345

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.4.2 or later on all search head cluster members
Inventory accounts holding roles with the edit_shcluster or equivalent search head clustering capability and remove the capability where not required
Rotate credentials for any high-privilege Splunk accounts if compromise is suspected
Review search head cluster member file systems for unauthorized files written since the deployment of 10.4.x

Patch Information

Splunk has released Splunk Enterprise 10.4.2 to remediate this issue. The patched version enforces the expected authorization boundary on the search head cluster member bundle REST API and validates bundle paths before writing content. Detailed remediation guidance is available in the Splunk Security Advisory SVD-2026-0801.

Workarounds

Restrict the Splunk management port (default 8089) to trusted administrative networks only
Remove search head clustering management capabilities from roles that do not operationally require them
Enforce multi-factor authentication for all administrative Splunk accounts to reduce credential-abuse risk
Downgrade to Splunk Enterprise below 10.4 is not recommended, but note that versions below 10.4 are not affected if a rollback is operationally required

bash

# Verify installed Splunk Enterprise version on each search head cluster member
$SPLUNK_HOME/bin/splunk version

# List roles that grant search head cluster management capability
$SPLUNK_HOME/bin/splunk list role -auth admin:<password> | grep -i shcluster

# Restrict management port exposure at the host firewall (Linux example)
iptables -A INPUT -p tcp --dport 8089 ! -s <admin_cidr> -j DROP