---
id: "CVE-2026-76289"
kind: "vulnerability"
aliases: ["CVE-2026-76289"]
title: "Splunk Enterprise: low-privilege user can crash instance via lookup REST API"
severity: "medium"
cvss: 6.5
epss: 0.00289
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["runtime", "self-hosted", "splunk-enterprise"]
not_affected_if: ["admin-or-power-only-accounts", "patched-version"]
published_at: "2026-10-21T23:17:26+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:48:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76289", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76289", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk Enterprise: low-privilege user can crash instance via lookup REST API

A user without the admin or power Splunk role can send a crafted request to the REST endpoint for lookup table files. The endpoint does not limit resources spent on response field selections, so the instance becomes unavailable to other users and needs a restart.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Splunk Enterprise version with `splunk version` and compare it against the fixed releases listed in the fix field.
- Review which accounts hold roles other than admin or power, since any authenticated user with such a role can send the request.

## Fix

- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16` depending on your release branch.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76289
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76289

## From the sources

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup table files. The affected instance requires a restart to restore service.
The vulnerability is possible because the endpoint does not limit resource use when it processes response field selections.
For more information see Endpoints reference list (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/introduction/endpoints-reference-list) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_