---
id: "CVE-2026-76294"
kind: "vulnerability"
aliases: ["CVE-2026-76294"]
title: "Splunk Enterprise: low-privilege users can move field extractions into unauthorized apps"
severity: "medium"
cvss: 4.3
epss: 0.00205
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["knowledge-objects", "package", "self-hosted", "splunk"]
not_affected_if: ["admin-power-only", "fixed-version"]
published_at: "2026-10-21T23:17:27+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:37:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76294", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76294", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk Enterprise: low-privilege users can move field extractions into unauthorized apps

Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11 and 9.4.16 lets a user without the admin or power role move field extractions or field transformations into apps they cannot read. The REST API does not check destination app access before performing the move.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Splunk Enterprise version (for example with `splunk version`) and compare it to the fixed releases listed in the fix
- Review which users hold roles other than admin or power and whether they can edit knowledge objects

## Fix

- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11` or `9.4.16` depending on the release line in use

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76294
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76294

## From the sources

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access.
The vulnerability is possible because the Representational State Transfer (REST) API does not validate destination app access before it processes field extraction and field transformation move operations.
For more information see Use the Field extractions page (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/use-the-settings-pages-for-field-extractions-in-splunk-web/use-the-field-extractions-page) and Manage knowledge object permissions (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.6/get-started-with-knowledge-objects/manage-knowledge-object-permissions) in the Splunk documentation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_