CVE-2026-76348 Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise

What is CVE-2026-76348?

CVE-2026-76348 is a low-severity missing authorization vulnerability in Splunk Splunk, published on 19 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control endpoints and change cluster state, which could allow for a denial of service. The vulnerability is possible because the Search Head Cluster member control endpoints do not require a state-changing Hypertext Transfer Protocol (HTTP) request type before they apply read-only authorization.

Weakness: CWE-862

Which versions are affected by CVE-2026-76348?

It affects 1 product.

Products include Splunk Splunk.

How do I fix CVE-2026-76348?

No fix has been published for CVE-2026-76348 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-76348 being exploited?

There is no known exploitation of CVE-2026-76348 in the wild and no public exploit code.

Other vulnerabilities in Splunk Splunk

• CVE-2026-20253 Splunk Enterprise Missing Authentication for Critical Function Exploited Critical 9.8
• CVE-2026-76268 Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise Critical 9.8
• CVE-2026-76284 Improper Neutralization in Splunk Enterprise Critical 9.8
• CVE-2026-76285 Improper Adherence to Coding Standards in Splunk Enterprise Critical 9.8
• CVE-2017-17067 Auth bypass in n/a Critical 9.8

All Splunk Splunk vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ccfh-cjv7-wqqx.