Live › vulnerability › CVE-2026-76296
Go to dashboardA Splunk Enterprise user without the admin or power role can create, move, edit, or delete sourcetype renaming configurations in apps they lack access to. The flaw exists because Splunk Web does not check app permissions before these operations run.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Splunk Enterprise deployments below the fixed versions where Splunk Web is turned on. The issue needs a logged-in user with some role other than admin or power, so instances where all users are admins or power users face less risk. Deployments with Splunk Web disabled are not affected per the description.
No product ranges from the sources yet.
splunk version and compare it against the fixed releases.10.4.4, 10.2.8, 10.0.11, or 9.4.16, matching the release line in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access. The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations. For more information see Rename source types at search time (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time) in the Splunk documentation.
This page as .md · .json · in your agent: get_signal("CVE-2026-76296")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.