CVE-2026-76317

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user without admin or power roles can move files readable by the Splunk Enterprise service account into a lookup they control. This allows unauthorized access to data and impacts system integrity and availability on the search head. The issue occurs because the lookup configuration endpoint fails to resolve lookup source paths before verifying if they remain within the permitted lookup staging area.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.