CVE-2026-76271

Executive Summary

CVE-2026-76271 is a denial-of-service vulnerability in the Splunk Enterprise "Discover Splunk Observability Cloud" app, affecting versions below 10.4.3, 10.2.7, and 10.0.10. A low-privileged authenticated user who does not hold the "admin" or "power" Splunk roles can submit crafted input to a REST API endpoint that is validated by an inefficient regular expression, causing resource exhaustion and degrading endpoint availability. The impact is availability-only (CVSS 6.5, A:H) against an authenticated-accessible component, with no known public exploit or proof-of-concept at time of writing.

Technical Analysis

The vulnerable component is a Representational State Transfer (REST) API endpoint exposed by the Discover Splunk Observability Cloud app within Splunk Enterprise. According to the NVD description, the root cause is the app's use of an inefficient regular expression to validate input submitted through that endpoint. This is consistent with CWE-407: Inefficient Algorithmic Complexity, commonly realized as catastrophic backtracking (ReDoS) in regex engines with backtracking semantics.

Attack surface characteristics:

• The endpoint is reachable over the network (AV:N) by an authenticated, low-privileged user (PR:L) who lacks the "admin" or "power" roles. No user interaction is required (UI:N).
• The flaw is scoped to the vulnerable app component (S:U), producing no confidentiality or integrity impact — only availability (C:N/I:N/A:H).
• REST endpoints in Splunk Enterprise are defined and governed by restmap.conf, which the vendor references for configuration context. The endpoint in question belongs to the Discover Splunk Observability Cloud app rather than core Splunk Enterprise.

Mechanism class: When user-supplied input matching a pathological pattern is passed to a backtracking regex evaluator, the engine explores an exponential number of alternative match paths. Single-threaded execution of the affected request-handling path occupies CPU and, in a server context, ties up the worker/thread handling the REST call. Repeated or amplified submissions can starve the endpoint and, depending on how the handler is scheduled, degrade availability of the service.

Insufficient technical detail is available in the provided data to identify the specific regex pattern, the exact endpoint path, or the parameter names involved. No public PoC, exploit code, or Nuclei template exists; the attack chain is inferred from the vulnerability class (inefficient algorithmic complexity in input validation).

Affected versions per the NVD description: Splunk Enterprise below 10.4.3, below 10.2.7, and below 10.0.10. Splunk Enterprise 9.4.x is explicitly not affected. No OSV package data or affected-version list beyond this was provided.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Only the REST API endpoint, the Discover Splunk Observability Cloud app, the inefficient regular expression, and the role constraints are established by the source data; no specific paths, parameters, or function names are fabricated here.

1. Reconnaissance / target identification The attacker identifies internet- or intranet-exposed Splunk Enterprise management interfaces (default web port 8000/8089) and enumerates app availability to determine whether the Discover Splunk Observability Cloud app is installed. Version fingerprinting (banner, login page, or accessible REST metadata) is used to confirm the deployment falls within the affected ranges.

2. Triggering the flaw class The attacker authenticates with a low-privileged account — one that does NOT hold the "admin" or "power" roles. Because the endpoint is reachable at the low-privilege authorization tier, the attacker submits input to the REST API endpoint that the app validates with the inefficient regular expression. At the vulnerability-class level, the payload is a string engineered to induce catastrophic backtracking in the regex evaluator (e.g., long repetitive structures that trigger exponential alternative matching). No specific parameter or pattern is asserted here because none is disclosed.

3. Execution method A single crafted request begins consuming excessive CPU on the handling thread. The attacker may submit repeated or concurrent requests to sustain resource consumption. Because the request only requires the privileges of a low-privileged authenticated user, no elevation or high-privilege role is needed.

4. Post-exploitation impact The effect is availability degradation of the affected REST API endpoint (and potentially broader service responsiveness if the handler shares resources). There is no data exfiltration, no code execution, and no integrity impact under the CVSS assessment. Sustained abuse can render the endpoint unresponsive to legitimate users, constituting a denial-of-service condition.

Impact Assessment

• CVSS 6.5 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
• Attack Vector (N): exploitable remotely — the endpoint is network-accessible.
• Attack Complexity (L): no specialized conditions; the regex-triggering input is straightforward to construct once the endpoint is known.
• Privileges Required (L): requires an authenticated low-privileged account without "admin" or "power" roles — lowering the bar for insiders, contractors, or any holder of a basic read-only role.
• User Interaction (N): none required.
• Scope (U): impact stays within the vulnerable component.
• Impact: Availability High; Confidentiality None; Integrity None.

Business impact: Splunk Enterprise is a security operations platform. Degrading a REST endpoint in the Discover Splunk Observability Cloud app can impair observability ingestion/query workflows and, depending on deployment topology, contribute to monitoring or detection gaps. Because the attacker needs only low privilege, the insider and multi-tenant risk is elevated. Blast radius is bounded to the affected endpoint/app rather than the entire Enterprise core, but availability degradation in a SOC tooling context carries outsized operational consequences.

EPSS: 0.00267 (17.3rd percentile) — low predicted likelihood of exploitation in the wild at present. Not listed in CISA KEV. No known threat actor campaign or exploit-in-the-wild evidence.

Detection Guidance

Sigma Rule

title: Suspicious REST API Request Targeting Splunk Observability Cloud App (CVE-2026-76271)
id: 9f2c1e7a-7627-4c1f-9b2a-splunkobs0001
status: experimental
description: Detects repeated or anomalous requests to the Discover Splunk Observability Cloud REST endpoint by low-privileged users, indicative of ReDoS/DoS activity (CVE-2026-76271).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76271
author: valtersit.com
date: 2026/01/01
logsource:
  product: splunk
  service: web
detection:
  selection_endpoint:
    uri|contains:
      - 'observability'
      - 'restmap'
  selection_role:
    splunk_role|contains:
      - 'user'
  condition: selection_endpoint and selection_role
fields:
  - src_ip
  - user
  - uri
  - status
falsepositives:
  - Legitimate high-volume app usage by non-privileged users
level: medium

YARA Rule

rule CVE_2026_76271_Splunk_Observability_ReDoS
{
    meta:
        description = "Detects references to the vulnerable Splunk Observability Cloud app REST endpoint and version ranges for CVE-2026-76271"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76271"
        severity = "medium"
    strings:
        $app = "Discover Splunk Observability Cloud" nocase
        $rest = "restmap.conf" nocase
        $ver1 = "10.4.3"
        $ver2 = "10.2.7"
        $ver3 = "10.0.10"
    condition:
        ($app or $rest) and any of ($ver*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76271 Splunk Observability Cloud REST endpoint abuse attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"observability"; nocase; http.uri; content:"/services/"; nocase; threshold: type both, track by_src, count 50, seconds 30; classtype:attempted-dos; sid:7627101; rev:1; reference:cve,2026-76271; metadata:affected_product Splunk_Enterprise;)

Elastic Detection

sequence by user.name, source.ip with maxspan=30s
  [network where network.protocol == "http" and url.path : "*observability*" and http.request.method in ("GET", "POST")]
  [network where network.protocol == "http" and url.path : "*observability*" and http.request.method in ("GET", "POST")]
  [network where network.protocol == "http" and url.path : "*observability*" and http.request.method in ("GET", "POST")]

Splunk SPL Query

index=_internal sourcetype=splunk_web_access OR sourcetype=splunkd_access
| search uri="*observability*" AND uri="*services*"
| stats count AS req_count, values(status) AS statuses, dc(uri) AS distinct_uris BY clientip, user
| where req_count > 100
| sort - req_count
| rename clientip AS src_ip

Wazuh OSSEC Rule

<group name="splunk,">
  <rule id="762710" level="8">
    <decoded_as>json</decoded_as>
    <field name="uri">observability</field>
    <description>CVE-2026-76271: Possible REST API DoS attempt against Splunk Observability Cloud app</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented in the tracked sources.

1. Immediate mitigations

• Restrict network exposure of Splunk Enterprise management and REST interfaces to trusted networks; do not expose them to the internet.
• Enforce least privilege: audit accounts that can reach the Discover Splunk Observability Cloud REST endpoint and remove unnecessary access for users who do not require it.
• If the app is not in active use, disable/remove the Discover Splunk Observability Cloud app to eliminate the vulnerable endpoint surface.
• Apply rate limiting or reverse-proxy request throttling in front of REST endpoints to blunt repeated submissions that sustain resource exhaustion.
• Monitor for anomalous request volumes against "observability" REST endpoints from low-privileged users.

2. Patch / upgrade steps

• Per the NVD description, upgrade Splunk Enterprise to 10.4.3, 10.2.7, or 10.0.10 (whichever applies to the deployed branch). Track the Splunk vendor advisory for the authoritative fix and confirmation.
• Splunk Enterprise 9.4.x is not affected and requires no change for this CVE.
• Validate the upgrade in a staging environment before production rollout; verify app compatibility with the target release.

3. Long-term hardening

• Maintain a formal patch management cadence for Splunk Enterprise and installed apps, including third-party/vendor apps such as Discover Splunk Observability Cloud.
• Harden role-based access control so that only the minimum required "power"/"admin" assignments exist, and review app-level REST endpoint authorization regularly.
• Implement input-length limits and server-side timeouts for REST handlers, and prefer linear-time validation logic where regex is used.
• Continuously inventory and remove unused apps to reduce attack surface.

References

• NVD — CVE-2026-76271: https://nvd.nist.gov/vuln/detail/CVE-2026-76271
• Splunk Docs — About configuring role-based user access: https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access
• Splunk Docs — Splunk Observability Cloud previews: https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/observability/splunk-observability-cloud-previews
• Splunk Docs — restmap.conf: https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.0-configuration-file-reference/restmap.conf
• CWE-407 — Inefficient Algorithmic Complexity: https://cwe.mitre.org/data/definitions/407.html
• CISA KEV Catalog (no entry for CVE-2026-76271 as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• No known threat actor campaigns or exploit-in-the-wild evidence identified. No public PoC or Nuclei template available.