{"id":"CVE-2026-76296","kind":"vulnerability","aliases":["CVE-2026-76296"],"related":[],"title":"Splunk Enterprise: low-privilege users can change sourcetype renames in restricted apps","description":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the \"admin\" or \"power\" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access.\nThe vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations.\nFor more information see Rename source types at search time (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time) in the Splunk documentation.","summary":"A Splunk Enterprise user without the admin or power role can create, move, edit, or delete sourcetype renaming configurations in apps they lack access to. The flaw exists because Splunk Web does not check app permissions before these operations run.","severity":"medium","cvss":4.3,"epss":0.00205,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["self-hosted","splunk-enterprise","vendor"],"not_affected_if":["fixed-version","splunk-web-disabled"],"how_to_check":"- Check the Splunk Enterprise version with `splunk version` and compare it against the fixed releases.\n- Confirm whether Splunk Web is enabled on the instance (unknown whether the sources give a specific command).","fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16`, matching the release line in use.","status":"open","published_at":"2026-10-21T23:17:27+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:37:35+00:00","updated_at":"2026-10-25T04:37:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:37:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16`, matching the release line in use.","reach":"network","title":"Splunk Enterprise: low-privilege users can change sourcetype renames in restricted apps","impact":"low","summary":"A Splunk Enterprise user without the admin or power role can create, move, edit, or delete sourcetype renaming configurations in apps they lack access to. The flaw exists because Splunk Web does not check app permissions before these operations run.","category":"vendor","nicknames":[],"who_cares":["splunk-enterprise","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Low-privilege user alters sourcetype renames in apps they cannot access","analyst_note":"","how_to_check":"- Check the Splunk Enterprise version with `splunk version` and compare it against the fixed releases.\n- Confirm whether Splunk Web is enabled on the instance (unknown whether the sources give a specific command).","needs_analyst":false,"not_affected_if":["splunk-web-disabled","fixed-version"],"who_is_affected":"Splunk Enterprise deployments below the fixed versions where Splunk Web is turned on. The issue needs a logged-in user with some role other than admin or power, so instances where all users are admins or power users face less risk. Deployments with Splunk Web disabled are not affected per the description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3510,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-76296':16A,19A '/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time)':149C '10.0.11':74C '10.2.8':73C '10.4.4':72C '9.4.16':76C 'access':50B,110C 'admin':33B,84C 'app':13A,47B,61B,102C,129C 'chang':8A 'check':60B 'configur':45B,97C 'could':89C 'creat':38B,90C 'cve':14A,17A 'delet':42B,94C 'document':153C 'edit':40B,92C 'enterpris':2A,25B,29B,69C 'exist':54B 'flaw':53B 'help.splunk.com':148C 'help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time)':147C 'hold':82C 'host':22B 'inform':139C 'lack':49B 'low':4A 'low-privileg':3A 'move':39B,91C 'oper':65B,136C 'perform':133C 'permiss':62B,108C,130C 'possibl':114C 'power':35B,86C 'privileg':5A 'renam':10A,44B,96C,135C,141C 'requir':128C 'restrict':12A 'role':36B,88C 'run':66B 'search':145C 'see':140C 'self':21B 'self-host':20B 'sourc':142C 'sourcetyp':9A,43B,95C,134C 'splunk':1A,24B,28B,56B,68C,87C,116C,122C,152C 'splunk-enterpris':23B 'time':146C 'turn':119C 'type':143C 'user':6A,30B,78C 'vendor':26B 'verifi':126C 'version':70C 'vulner':112C 'web':57B,117C,123C 'without':31B","nicknames":[],"mitigations":[],"who_affected":"Splunk Enterprise deployments below the fixed versions where Splunk Web is turned on. The issue needs a logged-in user with some role other than admin or power, so instances where all users are admins or power users face less risk. Deployments with Splunk Web disabled are not affected per the description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76296","severity":null,"published_at":"2026-10-21T23:17:27+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76296","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76296","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}