{"id":"CVE-2026-76297","kind":"vulnerability","aliases":["CVE-2026-76297"],"related":[],"title":"Splunk Enterprise: GET request lets phished user disable federated search providers","description":"In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches from retrieving data from remote datasets.\nThe vulnerability is possible because the federated provider Representational State Transfer (REST) API accepts GET requests for actions that change provider state.\nThe vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.\nFor more information see Run federated searches over remote Splunk platform deployments (https://help.splunk.com/en/splunk-enterprise/search/federated-search/10.6/run-federated-searches-across-other-splunk-deployments/run-federated-searches-over-remote-splunk-platform-deployments) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.","summary":"The federated provider REST API accepts GET requests for actions that change provider state, so a phished user with the edit_federated_providers capability can be tricked into disabling all federated search providers. The result is that federated searches may temporarily fail to retrieve data from remote datasets.","severity":"medium","cvss":4.2,"epss":0.00107,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["federated-search","package","splunk","splunk-enterprise"],"not_affected_if":["fixed-version","no-edit-federated-providers-role","no-federated-search"],"how_to_check":"- Check the Splunk Enterprise version with `splunk version` and compare it to the fixed releases listed in the fix section.\n- Confirm whether federated search is in use under Settings > Federated Search in the Splunk Web UI.","fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16` depending on the release branch in use.","status":"open","published_at":"2026-10-21T23:17:27+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:41:28+00:00","updated_at":"2026-10-25T04:41:28+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:41:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16` depending on the release branch in use.","reach":"internet","title":"Splunk Enterprise: GET request lets phished user disable federated search providers","impact":"low","summary":"The federated provider REST API accepts GET requests for actions that change provider state, so a phished user with the edit_federated_providers capability can be tricked into disabling all federated search providers. The result is that federated searches may temporarily fail to retrieve data from remote datasets.","category":"package","nicknames":[],"who_cares":["splunk","splunk-enterprise","federated-search"],"confidence":0.8,"needs_auth":"yes","worst_case":"Federated search providers get disabled, temporarily blocking remote dataset queries","analyst_note":"","how_to_check":"- Check the Splunk Enterprise version with `splunk version` and compare it to the fixed releases listed in the fix section.\n- Confirm whether federated search is in use under Settings > Federated Search in the Splunk Web UI.","needs_analyst":false,"not_affected_if":["fixed-version","no-federated-search","no-edit-federated-providers-role"],"who_is_affected":"Deployments of Splunk Enterprise below the fixed versions that use federated search, particularly where users hold a role with the edit_federated_providers capability. The attack needs a logged-in privileged user to be phished, so exposure is limited to environments where that role is assigned. Deployments without federated search or on fixed versions can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":3703,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-76297':14A,17A '/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities)':202C '/en/splunk-enterprise/search/federated-search/10.6/run-federated-searches-across-other-splunk-deployments/run-federated-searches-over-remote-splunk-platform-deployments)':190C '10.0.11':81C '10.2.8':80C '10.4.4':79C '9.4.16':83C 'abl':169C 'accept':31B,134C 'action':35B,138C 'affect':151C 'api':30B,133C 'attack':147C 'browser':162C 'capabl':49B,100C,199C 'chang':37B,140C 'could':87C,110C 'cve':12A,15A 'data':70B,117C 'dataset':73B,120C 'defin':192C 'deploy':187C 'disabl':8A,54B 'document':206C 'edit':46B,97C 'enterpris':2A,25B,76C 'exploit':109C,171C 'fail':67B 'feder':9A,19B,27B,47B,56B,63B,98C,105C,113C,127C,181C 'federated-search':18B 'get':3A,32B,135C 'help.splunk.com':189C,201C 'help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities)':200C 'help.splunk.com/en/splunk-enterprise/search/federated-search/10.6/run-federated-searches-across-other-splunk-deployments/run-federated-searches-over-remote-splunk-platform-deployments)':188C 'hold':92C 'inform':178C 'initi':157C 'let':5A 'may':65B 'packag':21B 'phish':6A,42B,149C 'platform':186C,197C 'possibl':124C 'prevent':112C 'provid':11A,28B,38B,48B,58B,99C,107C,128C,141C 'remot':72B,119C,184C 'represent':129C 'request':4A,33B,136C,159C 'requir':145C 'rest':29B,132C 'result':60B 'retriev':69B,116C 'role':94C,193C 'run':180C 'search':10A,20B,57B,64B,106C,114C,182C 'see':179C 'splunk':1A,22B,24B,75C,185C,196C,205C 'splunk-enterpris':23B 'state':39B,130C,142C 'success':108C 'temporarili':66B,111C 'transfer':131C 'trick':52B,88C,154C 'turn':102C 'unauthent':85C,164C 'user':7A,43B,86C,90C,152C,165C 'version':77C 'vulner':122C,144C,173C 'within':160C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Splunk Enterprise below the fixed versions that use federated search, particularly where users hold a role with the edit_federated_providers capability. The attack needs a logged-in privileged user to be phished, so exposure is limited to environments where that role is assigned. Deployments without federated search or on fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76297","severity":null,"published_at":"2026-10-21T23:17:27+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76297","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76297","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}