{"id":"CVE-2026-76289","kind":"vulnerability","aliases":["CVE-2026-76289"],"related":[],"title":"Splunk Enterprise: low-privilege user can crash instance via lookup REST API","description":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the \"admin\" or \"power\" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup table files. The affected instance requires a restart to restore service.\nThe vulnerability is possible because the endpoint does not limit resource use when it processes response field selections.\nFor more information see Endpoints reference list (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/introduction/endpoints-reference-list) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.","summary":"A user without the admin or power Splunk role can send a crafted request to the REST endpoint for lookup table files. The endpoint does not limit resources spent on response field selections, so the instance becomes unavailable to other users and needs a restart.","severity":"medium","cvss":6.5,"epss":0.00289,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","splunk-enterprise"],"not_affected_if":["admin-or-power-only-accounts","patched-version"],"how_to_check":"- Check the Splunk Enterprise version with `splunk version` and compare it against the fixed releases listed in the fix field.\n- Review which accounts hold roles other than admin or power, since any authenticated user with such a role can send the request.","fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16` depending on your release branch.","status":"open","published_at":"2026-10-21T23:17:26+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:48:49+00:00","updated_at":"2026-10-25T03:48:49+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:48:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16` depending on your release branch.","reach":"network","title":"Splunk Enterprise: low-privilege user can crash instance via lookup REST API","impact":"low","summary":"A user without the admin or power Splunk role can send a crafted request to the REST endpoint for lookup table files. The endpoint does not limit resources spent on response field selections, so the instance becomes unavailable to other users and needs a restart.","category":"runtime","nicknames":[],"who_cares":["splunk-enterprise","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Instance becomes unavailable to other users and needs restart","analyst_note":"","how_to_check":"- Check the Splunk Enterprise version with `splunk version` and compare it against the fixed releases listed in the fix field.\n- Review which accounts hold roles other than admin or power, since any authenticated user with such a role can send the request.","needs_analyst":false,"not_affected_if":["patched-version","admin-or-power-only-accounts"],"who_is_affected":"Any Splunk Enterprise instance below the fixed versions where users hold a Splunk role other than admin or power can be taken down through the lookup table REST endpoint. Instances where only admin and power users have accounts are not exposed to this route, and Splunk Cloud is outside this description.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3589,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-76289':16A,19A '/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access)':167C '/en/splunk-enterprise/rest-api-reference/10.4/introduction/endpoints-reference-list)':156C '10.0.11':79C '10.2.8':78C '10.4.4':77C '9.4.16':81C 'access':164C 'admin':31B,89C 'affect':121C 'api':13A,114C 'base':162C 'becom':63B 'configur':159C 'could':94C 'craft':39B 'crash':8A 'cve':14A,17A 'document':171C 'endpoint':44B,50B,115C,135C,151C 'enterpris':2A,26B,74C,98C 'field':58B,145C 'file':48B,119C 'help.splunk.com':155C,166C 'help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access)':165C 'help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/introduction/endpoints-reference-list)':154C 'hold':87C 'host':23B 'inform':149C 'instanc':9A,62B,99C,122C 'limit':53B,138C 'list':153C 'lookup':11A,46B,117C 'low':4A 'low-privileg':3A 'make':95C 'need':69B 'possibl':132C 'power':33B,91C 'privileg':5A 'process':143C 'refer':152C 'represent':110C 'request':40B,107C 'requir':123C 'resourc':54B,139C 'respons':57B,144C 'rest':12A,43B,113C 'restart':71B,125C 'restor':127C 'role':35B,93C,161C 'role-bas':160C 'runtim':20B 'see':150C 'select':59B,146C 'self':22B 'self-host':21B 'send':37B,105C 'servic':128C 'spent':55B 'splunk':1A,25B,34B,73C,92C,97C,170C 'splunk-enterpris':24B 'state':111C 'tabl':47B,118C 'transfer':112C 'unavail':64B,100C 'use':140C 'user':6A,28B,67B,83C,103C,163C 'version':75C 'via':10A 'vulner':130C 'without':29B","nicknames":[],"mitigations":[],"who_affected":"Any Splunk Enterprise instance below the fixed versions where users hold a Splunk role other than admin or power can be taken down through the lookup table REST endpoint. Instances where only admin and power users have accounts are not exposed to this route, and Splunk Cloud is outside this description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76289","severity":null,"published_at":"2026-10-21T23:17:26+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76289","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76289","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}