CVE-2026-76352: Splunk Enterprise Privilege Escalation

CVE-2026-76352 Overview

CVE-2026-76352 is an authorization bypass vulnerability in Splunk Enterprise. Low-privileged users without the admin or power Splunk roles can create or modify scripted lookups through generic transforms configuration endpoints. The endpoints fail to enforce the capabilities required for external lookup definitions. An authenticated attacker can execute an installed lookup script under the permissions of the Splunk Enterprise service account, gaining access to sensitive data and impacting system integrity and availability. The flaw maps to CWE-285: Improper Authorization.

Critical Impact
Authenticated low-privilege users can execute scripts as the Splunk service account, exposing indexed data and enabling integrity and availability compromise.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6 and 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76352 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76352

Vulnerability Analysis

The vulnerability resides in the generic transforms configuration endpoints of Splunk Enterprise. These endpoints manage entries typically written to transforms.conf, including external (scripted) lookup definitions. The endpoints do not verify that the requesting user holds the capabilities required to create or edit external lookups. Any authenticated user, regardless of role, can register or alter a scripted lookup that references a script already installed on the Splunk host.

When the scripted lookup subsequently runs, Splunk invokes the referenced script under the operating system account running the Splunk Enterprise process. That account typically has broad access to indexed data, configuration files, and system resources on the search head or indexer.

Root Cause

The root cause is missing capability enforcement in the generic transforms REST endpoints. Splunk's role-based access model relies on capabilities such as those documented in the Splunk platform roles reference to gate operations that create or modify external lookup definitions. The generic configuration endpoints bypass these capability checks, breaking the intended authorization boundary between standard users and privileged administrators.

Attack Vector

An attacker requires authenticated access to Splunk Enterprise with any role. The attacker submits a crafted request to a generic transforms configuration endpoint that defines a scripted lookup pointing to a script already present on disk in an allowed lookup script directory. Executing the lookup, directly or through a search, triggers the script under the Splunk service account. Exploitation is performed over the network against Splunk's management interface. See the Splunk Security Advisory SVD-2026-0801 for vendor-supplied technical details.

Detection Methods for CVE-2026-76352

Indicators of Compromise

New or modified entries in transforms.conf referencing external_cmd or external_type = python created by users without the admin or power role.
REST API calls to /servicesNS/-/-/data/transforms/lookups or generic configuration endpoints originating from low-privileged accounts.
Unexpected child processes spawned by the splunkd process, particularly Python interpreters or shell interpreters executing lookup scripts.

Detection Strategies

Audit _audit and _internal indexes for action=edit and action=create events targeting transforms conf objects, correlated with the initiating user's role.
Compare current transforms.conf contents across search heads against a known-good baseline and flag drift involving external lookup definitions.
Monitor endpoint telemetry for splunkd spawning interpreters that execute files from $SPLUNK_HOME/etc/apps/*/bin/ outside of scheduled search windows.

Monitoring Recommendations

Enable verbose auditing on Splunk configuration endpoints and forward audit logs to a segregated index reviewed by security operations.
Alert on any change to scripted lookup definitions performed by accounts lacking the admin_all_objects or equivalent capability.
Track authentication and session activity for accounts that suddenly interact with administrative REST endpoints they have not previously used.

How to Mitigate CVE-2026-76352

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later as applicable to the deployed branch.
Restrict access to the Splunk management port (default 8089) to trusted administrative networks only.
Review existing transforms.conf files for unauthorized external lookup entries and remove any that cannot be attributed to a legitimate administrator.

Patch Information

Splunk has released fixed builds in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Refer to the Splunk Security Advisory SVD-2026-0801 for the complete list of fixed builds and upgrade guidance. The patched releases enforce the required capabilities on the generic transforms configuration endpoints.

Workarounds

Remove or restrict lookup scripts under $SPLUNK_HOME/etc/apps/*/bin/ to only those required for production operations.
Use limits.conf to constrain external command execution and validate the python.version setting for scripted lookups.
Enforce least privilege on Splunk roles and audit custom roles that inherit broader capabilities than required.

bash

# Configuration example: restrict lookup script execution in limits.conf
[lookup]
max_lookup_matches = 1000

[python]
python.version = python3