CVE-2026-76338

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description An unauthenticated user with access to a trusted distributed search private key can forge an administrative session token. This allows the attacker to access all relevant data, compromise system integrity, and disrupt service availability. The issue occurs because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, which allows the request to fall back to shared local key material.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.