CVE-2026-76348

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user with a role containing the high-privilege list search head clustering capability can send a read request to Search Head Cluster member control endpoints to change the cluster state, potentially leading to a denial of service. This occurs because these endpoints do not require a state-changing Hypertext Transfer Protocol (HTTP) request type before applying read-only authorization.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.