CVE-2026-76269: Improper Access Control in Splunk Enterprise REST Search Job Retrieval

Vulnerability overview

CVE-2026-76269 is rated 6.5 and classified as CWE-639, Authorization Bypass Through User-Controlled Key. It concerns how search jobs are retrieved through the Splunk Enterprise REST API. Splunk issued the fix across the 10.4, 10.2 and 10.0 branches as part of its October 2026 batch, which totalled 22 CVEs and shipped through advisories SVD-2026-1001 and SVD-2026-1002. No exploitation in the wild and no public exploit code are recorded for the batch.

Mechanism and exploitation conditions

The weakness sits in the authorization check that should gate access to search job results. When the key or identifier in the retrieval request falls under the caller's control and the server fails to bind that identifier to the caller's own permissions, a user can reach job artefacts owned by someone else. Splunk notes that several flaws in this batch also affect Splunk Secure Gateway, so the same platform component family deserves close attention. Exploitation requires an authenticated position sufficient to call the relevant REST endpoints.

Impact

Search jobs often carry raw event data drawn from multiple indexes. Reading another team's job results can therefore expose log content that the requester was never authorised to see, including security telemetry, application records and personal data subject to regulatory handling rules. Because the flaw is a control gap instead of a memory corruption issue, it is also quiet: nothing crashes, and a successful read can leave no obvious operational trace.

Affected products and scope

The affected ranges across the batch are Splunk Enterprise 10.4.0 to 10.4.2, 10.2.0 to 10.2.6, 10.0.0 to 10.0.9 and 9.4.0 to 9.4.14, with fixes in 10.4.3, 10.2.7, 10.0.10 and 9.4.15. Splunk lists this identifier among those fixed on the broader set of branches rather than only the newest release.

Exposure context

ZoomEye reports 114,213 indexed instances for app="Splunk Enterprise" and 47,630 for app="Splunk". Those counts reflect internet-reachable product deployments, not confirmed vulnerable systems. Access control defects of this kind are invisible to external scanning, so the figures describe platform prevalence only.

Remediation and mitigations

Install the fixed release for your branch and then revisit role assignments, because a patched server still exposes whatever the current permission model permits. Audit REST access tokens, retire unused service accounts, and monitor search job retrieval patterns for requests that do not match normal ownership. Administrators must also complete the extra steps Splunk requires for CVE-2026-76264, CVE-2026-76265, CVE-2026-76272 and CVE-2026-76280.

References

• Splunk Patches 22 Flaws in Splunk Enterprise, SecurityOnline
• Splunk Security Advisories portal, advisory identifiers SVD-2026-1001 and SVD-2026-1002
• Splunk product security communication