CVE-2026-76296
published 2026-10-21CVE-2026-76296: In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit…
PriorityP425medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.21%
9.9th percentile
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access.
The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations.
For more information see Rename source types at search time (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time) in the Splunk documentation.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| splunk | splunk_enterprise | >= 10.0 < 10.0.11 | 10.0.11 |
| splunk | splunk_enterprise | >= 10.2 < 10.2.8 | 10.2.8 |
| splunk | splunk_enterprise | >= 10.4 < 10.4.4 | 10.4.4 |
| splunk | splunk_enterprise | >= 9.4 < 9.4.16 | 9.4.16 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 Splunk Web permission
vuldb·2026-10-22·CVSS 4.3
CVE-2026-76296 [MEDIUM] Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3 Splunk Web permission
A vulnerability classified as problematic was found in Splunk Enterprise up to 9.4.15/10.0.10/10.2.7/10.4.3. This affects an unknown function of the component Splunk Web. Executing a manipulation can lead to permission issues.
This vulnerability is handled as CVE-2026-76296. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
GHSA
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurat
ghsa_unreviewed·2026-10-22
CVE-2026-76296 [MEDIUM] CWE-862 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurat
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access.
The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations.
For more information see Rename source types at search time (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time) in the Splunk documentation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-21
Published