{"id":"CVE-2026-76294","kind":"vulnerability","aliases":["CVE-2026-76294"],"related":[],"title":"Splunk Enterprise: low-privilege users can move field extractions into unauthorized apps","description":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the \"admin\" or \"power\" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access.\nThe vulnerability is possible because the Representational State Transfer (REST) API does not validate destination app access before it processes field extraction and field transformation move operations.\nFor more information see Use the Field extractions page (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/use-the-settings-pages-for-field-extractions-in-splunk-web/use-the-field-extractions-page) and Manage knowledge object permissions (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/get-started-with-knowledge-objects/manage-knowledge-object-permissions) in the Splunk documentation.","summary":"Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11 and 9.4.16 lets a user without the admin or power role move field extractions or field transformations into apps they cannot read. The REST API does not check destination app access before performing the move.","severity":"medium","cvss":4.3,"epss":0.00205,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["knowledge-objects","package","self-hosted","splunk"],"not_affected_if":["admin-power-only","fixed-version"],"how_to_check":"- Check the installed Splunk Enterprise version (for example with `splunk version`) and compare it to the fixed releases listed in the fix\n- Review which users hold roles other than admin or power and whether they can edit knowledge objects","fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11` or `9.4.16` depending on the release line in use","status":"open","published_at":"2026-10-21T23:17:27+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:37:37+00:00","updated_at":"2026-10-25T04:37:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:37:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11` or `9.4.16` depending on the release line in use","reach":"network","title":"Splunk Enterprise: low-privilege users can move field extractions into unauthorized apps","impact":"low","summary":"Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11 and 9.4.16 lets a user without the admin or power role move field extractions or field transformations into apps they cannot read. The REST API does not check destination app access before performing the move.","category":"package","nicknames":[],"who_cares":["splunk","self-hosted","knowledge-objects"],"confidence":0.7,"needs_auth":"yes","worst_case":"low-privilege user moves knowledge objects into unreadable apps","analyst_note":"","how_to_check":"- Check the installed Splunk Enterprise version (for example with `splunk version`) and compare it to the fixed releases listed in the fix\n- Review which users hold roles other than admin or power and whether they can edit knowledge objects","needs_analyst":false,"not_affected_if":["fixed-version","admin-power-only"],"who_is_affected":"Any Splunk Enterprise deployment on the affected versions where users without the admin or power role can edit field extractions or transformations. Deployments already on the fixed releases, or where only admin and power users can manage knowledge objects, are not exposed by this flaw. The sources do not describe Splunk Cloud exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00064,"input_tokens":3610,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-76294':16A,19A '/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/get-started-with-knowledge-objects/manage-knowledge-object-permissions)':155C '/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/use-the-settings-pages-for-field-extractions-in-splunk-web/use-the-field-extractions-page)':147C '10.0.11':33B,76C '10.2.8':32B,75C '10.4.4':31B,74C '9.4.16':35B,78C 'access':64B,108C,125C 'admin':41B,86C 'api':58B,119C 'app':13A,52B,63B,99C,124C 'cannot':54B 'check':61B 'could':91C 'cve':14A,17A 'destin':62B,123C 'document':159C 'enterpris':2A,29B,71C 'extract':10A,47B,94C,130C,143C 'field':9A,46B,49B,93C,96C,129C,132C,142C 'help.splunk.com':146C,154C 'help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/get-started-with-knowledge-objects/manage-knowledge-object-permissions)':153C 'help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/use-the-settings-pages-for-field-extractions-in-splunk-web/use-the-field-extractions-page)':145C 'hold':84C 'host':26B 'inform':138C 'knowledg':21B,150C 'knowledge-object':20B 'let':36B 'low':4A 'low-privileg':3A 'manag':149C 'move':8A,45B,68B,92C,134C 'object':22B,151C 'oper':135C 'packag':23B 'page':144C 'perform':66B 'permiss':152C 'possibl':112C 'power':43B,88C 'privileg':5A 'process':128C 'read':55B,107C 'represent':115C 'rest':57B,118C 'role':44B,90C 'see':139C 'self':25B 'self-host':24B 'splunk':1A,27B,28B,70C,89C,158C 'state':116C 'transfer':117C 'transform':50B,97C,133C 'unauthor':12A 'use':140C 'user':6A,38B,80C,103C 'valid':122C 'version':72C 'vulner':110C 'without':39B","nicknames":[],"mitigations":[],"who_affected":"Any Splunk Enterprise deployment on the affected versions where users without the admin or power role can edit field extractions or transformations. Deployments already on the fixed releases, or where only admin and power users can manage knowledge objects, are not exposed by this flaw. The sources do not describe Splunk Cloud exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76294","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76294","severity":null,"published_at":"2026-10-21T23:17:27+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76294","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76294","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}