---
id: "CVE-2026-76297"
kind: "vulnerability"
aliases: ["CVE-2026-76297"]
title: "Splunk Enterprise: GET request lets phished user disable federated search providers"
severity: "medium"
cvss: 4.2
epss: 0.00107
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["federated-search", "package", "splunk", "splunk-enterprise"]
not_affected_if: ["fixed-version", "no-edit-federated-providers-role", "no-federated-search"]
published_at: "2026-10-21T23:17:27+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:41:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76297", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76297", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk Enterprise: GET request lets phished user disable federated search providers

The federated provider REST API accepts GET requests for actions that change provider state, so a phished user with the edit_federated_providers capability can be tricked into disabling all federated search providers. The result is that federated searches may temporarily fail to retrieve data from remote datasets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Splunk Enterprise version with `splunk version` and compare it to the fixed releases listed in the fix section.
- Confirm whether federated search is in use under Settings > Federated Search in the Splunk Web UI.

## Fix

- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16` depending on the release branch in use.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76297
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76297

## From the sources

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capability into turning off all federated search providers. Successful exploitation could temporarily prevent federated searches from retrieving data from remote datasets.
The vulnerability is possible because the federated provider Representational State Transfer (REST) API accepts GET requests for actions that change provider state.
The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.
For more information see Run federated searches over remote Splunk platform deployments (https://help.splunk.com/en/splunk-enterprise/search/federated-search/10.6/run-federated-searches-across-other-splunk-deployments/run-federated-searches-over-remote-splunk-platform-deployments) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_