CVE-2026-76355: Splunk Enterprise Info Disclosure Flaw

CVE-2026-76355 Overview

CVE-2026-76355 is a missing authentication vulnerability [CWE-306] in Splunk Enterprise 10.4 versions below 10.4.2. The flaw exists in a Representational State Transfer (REST) API endpoint associated with the Edge Processor service. An unauthenticated remote attacker can query the endpoint and retrieve information contained in Edge Processor pipeline configurations when Edge Processor is turned on. The vulnerability does not affect Splunk Enterprise versions prior to 10.4.

Critical Impact
Unauthenticated network attackers can read Edge Processor pipeline configurations, exposing data-routing logic and potentially sensitive processing rules from affected Splunk Enterprise deployments.

Affected Products

Splunk Enterprise 10.4.0
Splunk Enterprise 10.4.1
Splunk Enterprise 10.4 releases below 10.4.2 with Edge Processor enabled

Discovery Timeline

2026-08-19 - CVE-2026-76355 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76355

Vulnerability Analysis

The vulnerability resides in the Edge Processor service endpoint exposed by Splunk Enterprise 10.4. The endpoint accepts requests over the network without enforcing authentication controls. When Edge Processor is enabled, any client that can reach the REST interface can retrieve the pipeline configuration data returned by that endpoint.

Edge Processor pipelines define how data is filtered, masked, transformed, and routed before ingestion. Disclosure of these configurations exposes routing destinations, field-level processing logic, and any inline rules embedded in the pipeline definitions. Only confidentiality is impacted; the CVSS vector indicates no integrity or availability effects.

Root Cause

The root cause is a missing authentication check [CWE-306] on the Edge Processor REST API endpoint. The service handler processes requests and returns pipeline configuration data without validating a session token, API key, or Splunk role. Because the endpoint is bound to the network-accessible management interface, the missing check translates directly into an unauthenticated disclosure primitive.

Attack Vector

Exploitation is remote and requires no privileges or user interaction. An attacker who can reach the Splunk Enterprise REST management interface issues a request to the Edge Processor endpoint and receives pipeline configuration data in the response. The prerequisite is that Edge Processor is turned on in the target instance. Deployments that have not enabled Edge Processor are not exposed.

No verified public proof-of-concept code is available at the time of publication. See the Splunk Security Advisory SVD-2026-0801 for vendor-published technical details.

Detection Methods for CVE-2026-76355

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Edge Processor REST endpoints in the Splunk management interface access logs
Requests to Edge Processor URIs from source addresses outside expected administrative networks
Anomalous spikes in REST API requests targeting Edge Processor pipeline configuration paths

Detection Strategies

Review Splunk internal access logs (_internal index, splunkd_access.log) for requests to Edge Processor endpoints without an associated authenticated user
Correlate REST API requests to Edge Processor paths with source IP allowlists for administrative access
Alert on any request to Edge Processor configuration endpoints that returns HTTP 200 without an authentication header

Monitoring Recommendations

Ingest Splunk splunkd_access.log and splunkd.log into a centralized SIEM for continuous monitoring of management-plane requests
Baseline normal Edge Processor administrative traffic and alert on deviations in source, volume, or timing
Monitor perimeter and network devices for connections to Splunk management ports (default 8089) from untrusted networks

How to Mitigate CVE-2026-76355

Immediate Actions Required

Upgrade Splunk Enterprise 10.4 deployments to version 10.4.2 or later as published in the vendor advisory
Inventory all Splunk Enterprise instances to identify those running 10.4.x with Edge Processor enabled
Restrict network access to the Splunk management REST interface to trusted administrative subnets until patches are applied

Patch Information

Splunk has published fixed versions in Splunk Security Advisory SVD-2026-0801. Upgrade Splunk Enterprise to version 10.4.2 or later. Versions prior to 10.4 are not affected and do not require a patch for this issue.

Workarounds

Disable Edge Processor on affected 10.4.x instances if the feature is not required, which removes exposure to the vulnerable endpoint
Place the Splunk management interface behind a network access control list that restricts inbound traffic to authorized administrator hosts
Front the REST management interface with a reverse proxy that enforces authentication before requests reach Splunk

bash

# Example: restrict access to the Splunk management port (8089) via iptables
iptables -A INPUT -p tcp --dport 8089 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8089 -j DROP