CVE-2026-76354: Splunk Enterprise Privilege Escalation

CVE-2026-76354 Overview

CVE-2026-76354 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability allows a low-privileged authenticated user, one who does not hold the admin or power Splunk roles, to compromise system integrity and availability. An attacker sends a crafted Representational State Transfer (REST) API request that deletes or temporarily overwrites files writable by the Splunk service account on a non-captain search head cluster member. The flaw stems from Search Head Clustering bundle replication failing to validate replicated bundle file names or neutralize NUL bytes [CWE-158] before constructing the member bundle path.

Critical Impact
An authenticated non-admin user can delete or overwrite arbitrary files writable by the Splunk service account across cluster members, disrupting availability and corrupting search head state.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6, 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76354 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76354

Vulnerability Analysis

Splunk Enterprise uses Search Head Clustering (SHC) to distribute configuration bundles from the cluster captain to member nodes. The bundle replication routine constructs a destination path on each member using the file name supplied in the replication request. The routine does not validate the replicated bundle file name and does not neutralize NUL bytes embedded in the name before assembling the target path.

An authenticated user without the admin or power roles can send a crafted REST API request that supplies a file name containing NUL bytes or path components. The Splunk process on a non-captain member then writes or deletes files outside the intended bundle directory. Affected files are limited to those writable by the operating system account running Splunk Enterprise, but that scope often includes indexes, configuration files, and application state.

Root Cause

The root cause is improper neutralization of null bytes in a pathname [CWE-158] combined with missing input validation on the replicated bundle file name. When the file name is passed to file system APIs, NUL byte truncation causes the path resolver to interpret a different destination than the application expected.

Attack Vector

The attack is network-reachable and requires low-privilege authentication. The attacker targets a non-captain search head cluster member with a crafted REST API request that triggers bundle replication logic. Successful exploitation results in file deletion or temporary overwrite, impacting integrity and availability without exposing confidentiality.

No public proof-of-concept code is available. See the Splunk Security Advisory SVD-2026-0801 for vendor-provided technical detail.

Detection Methods for CVE-2026-76354

Indicators of Compromise

Unexpected file deletions or modifications under Splunk installation directories, particularly on non-captain SHC members.
REST API requests to bundle replication endpoints originating from user accounts that lack the admin or power roles.
Bundle replication log entries referencing file names with unusual path separators or embedded control characters.

Detection Strategies

Enable and review Splunk internal audit logs (_audit, _internal) for anomalous REST API calls targeting SHC replication endpoints.
Baseline the set of accounts authorized to invoke replication operations and alert on deviations.
Correlate file integrity monitoring events on Splunk hosts with authenticated REST API activity to detect out-of-band writes.

Monitoring Recommendations

Deploy file integrity monitoring on $SPLUNK_HOME and any directories writable by the Splunk service account.
Forward host and application logs from every SHC member to a centralized analytics platform for cross-node correlation.
Alert on REST API 4xx and 5xx patterns tied to bundle replication paths that may indicate exploitation attempts.

How to Mitigate CVE-2026-76354

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14, whichever aligns with the deployed release train.
Audit Splunk role assignments and remove unnecessary user accounts from search head cluster members.
Restrict network access to SHC replication endpoints so only trusted management networks can reach them.

Patch Information

Splunk has published fixes in Splunk Enterprise 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Refer to the Splunk Security Advisory SVD-2026-0801 for the authoritative patch matrix and upgrade guidance.

Workarounds

Follow Splunk guidance on securing service accounts so the Splunk process runs with the minimum file system privileges required.
Restrict REST API access using network controls and reverse proxy rules until the upgrade is deployed.
Review and tighten Splunk role capabilities to ensure only trusted users can authenticate to cluster members.

bash

# Verify installed Splunk Enterprise version on each SHC member
$SPLUNK_HOME/bin/splunk version

# List current SHC members and identify the captain
$SPLUNK_HOME/bin/splunk show shcluster-status -auth <admin>:<password>