CVE-2026-76269 Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise

Medium 6.5 Published 7 Oct 2026 Updated 10 Oct 2026

Unprivileged users can access other users' search job data via the REST API due to missing ownership validation in Splunk Enterprise.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-76269?

CVE-2026-76269 is a medium-severity missing authorization vulnerability in Splunk Splunk, published on 7 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job metadata, results, and preview results, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully validate job ownership before returning search job information.

Weakness: CWE-639

Which versions are affected by CVE-2026-76269?

It affects 1 product.

Products include Splunk Splunk.

How do I fix CVE-2026-76269?

No fix has been published for CVE-2026-76269 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-76269 being exploited?

There is no known exploitation of CVE-2026-76269 in the wild and no public exploit code.

All Splunk Splunk vulnerabilities

Sources

Also known as GHSA-hrww-75rf-ph52.