Live › vulnerability › CVE-2026-76289
Go to dashboardA user without the admin or power Splunk role can send a crafted request to the REST endpoint for lookup table files. The endpoint does not limit resources spent on response field selections, so the instance becomes unavailable to other users and needs a restart.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Splunk Enterprise instance below the fixed versions where users hold a Splunk role other than admin or power can be taken down through the lookup table REST endpoint. Instances where only admin and power users have accounts are not exposed to this route, and Splunk Cloud is outside this description.
No product ranges from the sources yet.
splunk version and compare it against the fixed releases listed in the fix field.10.4.4, 10.2.8, 10.0.11, or 9.4.16 depending on your release branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup table files. The affected instance requires a restart to restore service. The vulnerability is possible because the endpoint does not limit resource use when it processes response field selections. For more information see Endpoints reference list (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/introduction/endpoints-reference-list) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
This page as .md · .json · in your agent: get_signal("CVE-2026-76289")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.