CVE-2026-76264

Executive Summary

CVE-2026-76264 is an improper authorization vulnerability in Splunk Enterprise that allows an authenticated user who does not hold the "admin" or "power" Splunk roles to create or edit scripted lookup definitions through raw configuration endpoints. The flaw exists because raw transforms configuration write paths do not apply external lookup capability checks before persisting scripted lookup settings. Although rated only 4.3 (Low) on CVSS, the true risk lies in the fact that scripted lookups execute external commands under the Splunk service account — turning a low-privilege misconfiguration write into a potential remote code execution primitive that warrants attention despite the modest score.

Technical Analysis

CVE-2026-76264 is classified under CWE-863 (Incorrect Authorization). The NVD description states that in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The root cause is that raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.

This is an authorization-enforcement gap in the configuration-write path rather than an injection or memory-safety flaw. Splunk exposes two broad ways to modify configuration: the higher-level REST API (which performs role and capability checks) and "raw" configuration endpoints that read and write .conf files directly (typically transforms.conf in this case). The vulnerability arises because the raw write path for transforms configuration does not validate the run_script/external lookup capability before accepting scripted lookup definitions.

A "scripted lookup" is a Splunk construct that maps lookup keys to values by invoking an external program or script (referenced in the lookup stanza and executed by the Splunk platform). Because a user who lacks the admin or power roles can still write these definitions through the raw endpoint, they can register a scripted lookup that points to code. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N reflects: network reachable, low attack complexity, low privileges required (any authenticated account), no user interaction, unchanged scope, and impact limited to integrity. The Integrity-only scoring reflects that the injected configuration itself is the direct impact — the downstream consequence of script execution is not modeled by the CVSS v3.1 scoring rubric and may exceed what the 4.3 base score implies.

No public proof-of-concept, Nuclei template, or exploit code is associated with this CVE at the time of writing, so the specific raw endpoint paths, configuration keys, and payload syntax are not documented here. Analysis is limited to the authorization class and attack surface described by the NVD entry.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-863, improper capability check on a config-write path) and the NVD description. No specific endpoint paths or parameter names are asserted beyond those in the description.

1. Reconnaissance / target identification. The attacker identifies a reachable Splunk Enterprise management or web interface (default port 8000 for the web UI, 8089 for the management API). The attacker must already possess a valid low-privileged Splunk account that authenticates successfully but does not hold the "admin" or "power" roles. In many deployments shared analyst accounts exist, making this the low bar the vulnerability assumes.

2. Triggering the flaw. Rather than using the role-checked REST surface, the attacker directs configuration write requests at the raw transforms configuration write path described in the NVD entry. Because that path fails to apply the external lookup capability check, the write succeeds despite the account lacking the required capability. The attacker uses this to create or edit a scripted lookup definition.

3. Execution method (class level). A scripted lookup definition references an external script or command that Splunk invokes to resolve lookup values. By controlling the scripted lookup definition, the attacker registers their own external program/script as the resolver. When the lookup is invoked (for example, by a search that references it, or by any process that resolves the lookup), Splunk executes the referenced program under the privileges of the Splunk service account. No specific function names or file paths are stated in the source data, so the precise invocation mechanism and required fields are not enumerated here.

4. Post-exploitation impact. Code execution under the Splunk service account is commonly a high-impact outcome because that account often has broad read access to indexed data, credentials in configuration files, and frequently elevated OS privileges. However, the CVSS vector records the scored impact as Integrity-only with unchanged scope; the confidentiality and availability consequences are a function of what the executed script does and the deployment's local privilege configuration, which is not modeled by the score.

Impact Assessment

The CVSS v3.1 base score is 4.3 (Low) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

• Attack Vector (N — Network): exploitation is possible remotely over the network; no physical or adjacent access required.
• Attack Complexity (L — Low): no specialized conditions or race windows are described; the write path simply omits a check.
• Privileges Required (L — Low): any authenticated user without admin/power roles can attempt it — the defining characteristic of the CVE.
• User Interaction (N — None): no victim action needed to write the configuration.
• Scope (U — Unchanged): the vulnerable component's security authority is not scored as extending to another component, though in practice script execution may cross trust boundaries.
• Confidentiality (N — None) / Integrity (L — Low) / Availability (N — None): scored impact is limited to integrity, i.e., the unauthorized modification/creation of scripted lookup definitions.

Blast radius and business impact. The direct, scored impact is unauthorized configuration modification on the Splunk instance. The material risk is downstream: scripted lookups execute external programs, so an attacker able to define them may achieve code execution in the context of the Splunk service account. Where that account holds elevated rights, the practical blast radius can extend well beyond the 4.3 score, including access to indexed telemetry, stored credentials, and potentially the underlying host. Organizations using Splunk as a central SOC platform should treat this as a privilege-escalation of concern even at a Low base score. EPSS is 0.00173 (~6.1st percentile), and the CVE is not in the CISA KEV catalog, indicating low current observed exploitation.

Detection Guidance

Sigma Rule

title: Splunk Unauthorized Scripted Lookup Definition Creation via Raw Config Endpoint
id: 8f2a1c40-1c7e-4b9a-9c33-7d5b0e2a6f14
status: experimental
description: Detects creation or modification of scripted lookup definitions by users lacking admin/power roles, consistent with CVE-2026-76264 abuse of raw transforms configuration write paths.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76264
author: valtersit.com
date: 2026-01-01
tags:
  - attack.persistence
  - attack.defense-evasion
  - cve.2026.76264
logsource:
  product: splunk
  service: audit
detection:
  selection_action:
    action|contains:
      - 'edit'
      - 'create'
  selection_object:
    object|contains: 'transforms'
  selection_scripted:
    'config_data|contains|all':
      - 'scripted'
    'config_data|contains':
      - 'external'
  filter_admin:
    user_role:
      - 'admin'
      - 'power'
  condition: (selection_action and selection_object and selection_scripted) and not filter_admin
falsepositives:
  - Legitimate administrators configuring scripted lookups
level: medium

YARA Rule

rule CVE_2026_76264_Splunk_Scripted_Lookup_Config
{
    meta:
        author = "valtersit.com"
        description = "Detects scripted lookup definitions written via Splunk raw transforms configuration, consistent with CVE-2026-76264."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76264"
        date = "2026-01-01"
        severity = "low"

    strings:
        $stanza = "[scripted_lookup"
        $def = "definition"
        $ext = "external_lookup"
        $run = "run_script"
        $cmd = "script"

    condition:
        filesize < 1MB and
        ($stanza or ($def and $ext)) and ($run or $cmd)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76264 Splunk Unauthorized Scripted Lookup Configuration Write"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/services/configs/conf-transforms/"; http.uri; content:"scripted_lookup"; nocase; http.request_body; content:"definition"; nocase; http.request_body; content:"script"; nocase; classtype:attempted-admin; reference:cve,2026-76264; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76264; sid:202676264; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name with maxspan=30s
  [ any where event.category == "authentication" and event.outcome == "success" ]
  [ any where
      event.action : ("create" or "edit" or "update") and
      (url.path : "*conf-transforms*" or splunk.object : "*transforms*") and
      (splunk.config : "*scripted_lookup*" or splunk.config : "*external*") and
      not user.roles : ("admin" or "power")
  ]

Splunk SPL Query

index=_audit OR index=_internal action=edit OR action=create object=transforms
| eval user_roles = coalesce(roles, role, "unknown")
| search NOT user_roles="admin" NOT user_roles="power"
| where match(object, "(?i)transforms") AND (match(comment, "(?i)scripted") OR match(config_data, "(?i)external_lookup") OR match(config_data, "(?i)script"))
| table _time user action object comment user_roles src ip
| sort - _time

Wazuh OSSEC Rule

<group name="splunk,cve-2026-76264,">
  <rule id="2026764" level="8">
    <if_sid>100100</if_sid>
    <field name="object">transforms</field>
    <field name="action">edit|create</field>
    <regex type="pcre2">(?i)scripted|external_lookup|run_script</regex>
    <description>CVE-2026-76264: Possible unauthorized scripted lookup definition change in Splunk by non-admin user</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>config_change,</group>
  </rule>

  <rule id="2026765" level="12">
    <if_sid>2026764</if_sid>
    <field name="user_role">^(?!.*(admin|power)).*$</field>
    <description>CVE-2026-76264: Scripted lookup written by user lacking admin/power role</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict scripted lookup and transforms configuration privileges to the "admin" role only; audit role definitions to ensure no custom role grants write access to raw configuration endpoints.
   • Constrain network exposure of Splunk management/web interfaces (8000/8089) to trusted management networks and VPN only.
   • Audit existing scripted lookup definitions in transforms configuration and any referenced external scripts; alert on creation of new scripted lookups.
   • Apply least privilege to the OS account running the Splunk service so that script execution cannot escalate to root/administrator.
   • Freeze and baseline transforms configuration; enable file-integrity monitoring (Wazuh, osquery, or equivalent) on the relevant .conf files.

2. Patch / upgrade steps

   • Upgrade Splunk Enterprise to a release at or above the fix versions named in the NVD description: 10.4.2, 10.2.6, 10.0.10, or 9.4.15 (whichever branch applies).
   • Confirm the upgrade resolves the authorization check on the raw transforms write path; validate that non-admin/non-power accounts can no longer create or edit scripted lookups.
   • Monitor the Splunk vendor advisory channel for a formally published security bulletin and updated fixed versions; verify any patch against the authorization behavior described here.

3. Long-term hardening

   • Enforce strict RBAC review cycles and eliminate unnecessary raw-configuration write capabilities from all non-admin roles.
   • Adopt centralized configuration management (e.g., deployer/apps) so ad-hoc raw config writes are anomalies.
   • Enable comprehensive audit logging of configuration changes and forward it to an out-of-band SIEM so configuration tampering is detected even if the local Splunk instance is compromised.
   • Run the Splunk service under a dedicated low-privilege account with application allowlisting to limit the value of scripted-lookup code execution.

References

• NVD — CVE-2026-76264: https://nvd.nist.gov/vuln/detail/CVE-2026-76264
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-76264 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score 0.00173): https://www.first.org/epss/
• Splunk Security Advisories (vendor product security portal): https://advisory.splunk.com/

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild activity is associated with CVE-2026-76264 at the time of writing. No threat actor campaigns have been attributed.