CVE-2026-76275

Executive Summary

CVE-2026-76275 is an improper authorization vulnerability in Splunk Enterprise's REST API search job listing functionality, affecting versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15. Authenticated users who do not hold the "admin" or "power" roles can access search query text and job metadata belonging to other users, including job identifiers, dispatch parameters, result counts, and execution metadata. The impact is a confidentiality breach of search job data across user boundaries, with a CVSS base score of 4.3 (Low severity) reflecting the requirement for prior authentication and the limited scope of information disclosure.

Technical Analysis

The vulnerability class is CWE-285: Improper Authorization, specifically a broken object-level or per-user authorization check within a REST API endpoint responsible for listing search jobs. According to the NVD description, the REST API "does not fully enforce per-user authorization before it includes job information in search job listings." This means the authorization logic that should filter search job listings to only those owned by (or accessible to) the requesting user is incompletely applied — job information for jobs belonging to other users is included in the listing response.

The exposed data elements are explicitly enumerated in the description:

• Search query text (the SPL or query string submitted by the job owner)
• Job identifiers
• Dispatch parameters
• Result counts
• Execution metadata

No specific endpoint path, parameter name, or function name is provided in the NVD description or CNA title, so the exact REST route and parameter that controls the listing scope cannot be confirmed from available data. The attack surface is the Splunk Enterprise REST API, which is network-accessible and authenticated. The precondition for exploitation is an authenticated session with a role lower than "admin" or "power" — meaning ordinary users with any role that can query the search job listing endpoint.

The CVSS vector reflects the following characteristics:

• AV:N (network exploitable over the REST API)
• AC:L (no special conditions beyond authentication)
• PR:L (attacker must hold a valid low-privileged account)
• UI:N (no victim interaction required)
• S:U (impact confined to the vulnerable component)
• C:L (limited confidentiality impact — metadata and query text exposure, not arbitrary data or credentials)
• I:N (no integrity impact)
• A:N (no availability impact)

Notably, this is an authorization bypass rather than an authentication bypass. The flaw does not grant access to jobs that a user was never permitted to see at the object level in a secure design; it fails to enforce the per-user scoping that should have been applied when assembling job listings. This distinction matters for detection: the attacker is already an authenticated user, and their activity may superficially resemble legitimate search job enumeration.

Exploitation Scenarios

No public PoC, Exploit-DB entry, or Nuclei template is available; the attack chain below is inferred at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Splunk Enterprise REST API endpoint. Version fingerprinting (via response headers, the login interface, or version endpoints) establishes whether the target falls below one of the fixed versions: 10.4.3, 10.2.7, 10.0.10, or 9.4.15.

2. Authentication with a low-privileged account. The attacker obtains or already holds valid credentials for a user without the "admin" or "power" roles. This could be a legitimate low-privilege account, a service account, or credentials harvested through unrelated means. Because PR:L applies, this step is a hard prerequisite.

3. Triggering the flawed listing behavior. The attacker issues requests to the Splunk REST API search job listing functionality. Because the API "does not fully enforce per-user authorization before it includes job information in search job listings," the response includes job entries that belong to other users rather than being scoped to the requesting user. No special payload, injection string, or malformed input is required — the vulnerability is triggered simply by requesting the listing as an unauthorized (non-admin/non-power) user.

4. Post-exploitation impact. The attacker collects search query text, job identifiers, dispatch parameters, result counts, and execution metadata for jobs owned by other users. This does not directly yield the search result rows themselves per the description, but query text can reveal sensitive operational details: what data sources are being queried, what detections or analytics are configured, what indicators of compromise are being searched for, and the cadence and scope of other teams' investigations. Job identifiers and dispatch parameters may additionally be reusable for follow-up requests against other (possibly better-protected) job-related endpoints, depending on the deployment.

Impact is bounded: confidentiality only, no integrity or availability impact, and limited severity due to the authentication requirement. There is no evidence of in-the-wild exploitation, CISA KEV listing, or public exploit code at the time of writing.

Impact Assessment

The business impact centers on information disclosure across user and team boundaries within a Splunk deployment. Splunk search queries frequently contain sensitive content: internal hostnames, IP addresses, user identifiers, threat-hunting hypotheses, detection logic under development, and references to security incidents. An attacker with a low-privileged account can harvest this contextual intelligence, effectively mapping the organization's detection and response posture from the inside.

Blast radius is limited to Splunk Enterprise deployments running affected versions and reachable by the attacker's authenticated session. Internet-facing Splunk instances are the highest risk; internal-only deployments are exploitable by any authenticated insider or by an attacker who has already obtained a low-privileged foothold. Because no user interaction is required (UI:N) and complexity is low (AC:L), exploitation is trivial once credentials exist.

The CVSS score of 4.3 reflects the constrained nature of the impact: limited confidentiality (C:L) with no integrity or availability consequences. However, in a SIEM context, even limited query and metadata disclosure can be operationally significant — an adversary can learn what the SOC is looking for, which detections are active, and where blind spots may exist. EPSS is 0.00201 (9.1st percentile), indicating a low predicted probability of exploitation in the near term, consistent with the absence of public exploit tooling.

No affected version ranges, OSV packages, or vendor fix references were returned by tracked sources, and patch confidence is 0/4.

Detection Guidance

Sigma Rule

title: Splunk REST API Search Job Listing Cross-User Enumeration (CVE-2026-76275)
id: 8f3a1c2e-7b94-4d1a-9e6f-2c5b8a0d4e13
status: experimental
description: Detects authenticated low-privileged users enumerating Splunk REST API search job listings in a manner consistent with CVE-2026-76275, where per-user authorization is not fully enforced.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76275
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1213
logsource:
  category: webserver
  product: splunk
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/services/search/jobs'
      - '/services/search/jobs/'
  selection_method:
    cs-method: 'GET'
  filter_admin_power:
    cs-username|endswith:
      - 'admin'
  condition: selection_endpoint and selection_method and not filter_admin_power
fields:
  - c_ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate dashboard or automation accounts listing their own jobs
  - Scheduled searches executed by service accounts
level: low

YARA Rule

rule CVE_2026_76275_Splunk_Job_Listing_Authz
{
    meta:
        description = "Detects Splunk REST API responses exposing cross-user search job listings (CVE-2026-76275)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76275"
        date = "2026-01-01"
        severity = "low"

    strings:
        $splunk_job = "search/jobs"
        $entry_meta = "<s:key name=\"dispatchState\""
        $entry_owner = "<s:key name=\"owner\""
        $entry_query = "<s:key name=\"search\""
        $eai = "<eai:acl"

    condition:
        uint16(0) == 0x3C3F and
        $splunk_job and
        $eai and
        2 of ($entry_meta, $entry_owner, $entry_query)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76275 Splunk REST API Search Job Listing Cross-User Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/services/search/jobs"; http.uri; pcre:"/\/services\/search\/jobs(\/|\?|$)/i"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-recon; reference:cve,CVE-2026-76275; sid:202676275; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method == "GET" and
   stringContains(http.request.path, "/services/search/jobs") and
   not user.roles in ("admin", "power")]
| reduce count = count(), values(http.request.path), values(http.response.status_code)

Splunk SPL Query

index=_internal source=*splunkd_access.log* OR index=_audit action=search
| eval is_job_listing=if(match(uri_path, "/services/search/jobs"), 1, 0)
| where is_job_listing=1
| search NOT user IN ("admin","power") NOT role IN ("admin","power")
| stats count AS listing_requests, dc(uri_path) AS distinct_paths, values(status) AS statuses BY user, src_ip
| where listing_requests > 25
| sort - listing_requests

Wazuh OSSEC Rule

<group name="splunk,web,attack,">
  <rule id="100762" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/services/search/jobs</field>
    <description>CVE-2026-76275: Low-privileged Splunk user accessed REST API search job listing (possible cross-user job metadata access).</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_76275,attempted_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to the Splunk REST API management port (default TCP/8089) and web interface (default TCP/8000) to trusted management networks only; never expose Splunk management APIs directly to the internet.
   • Audit and minimize the number of accounts that can authenticate with roles below "admin" and "power" and that can reach the search job listing API. Disable or expire dormant accounts.
   • Where feasible, apply role-based search restrictions and access controls at the data and app level in Splunk so that redundant metadata exposure across teams does not translate into broader intelligence leakage.
   • Monitor authentication and REST access logs for anomalous job listing enumeration patterns from low-privileged accounts.

2. Patch/upgrade steps

   • No patch reference, vendor fix, or fixed-version mapping was returned by tracked sources (patch confidence 0/4). Splunk Enterprise versions at or above 10.4.3, 10.2.7, 10.0.10, and 9.4.15 are stated in the NVD description as not affected; upgrade-planning should target those baselines.
   • Because no authoritative advisory has been tracked, verify current fixed versions and release notes directly from the vendor before scheduling upgrades. Do not treat the version numbers in the description as a substitute for a vendor-confirmed patch announcement.
   • Stage upgrades through a test deployment, validate role-based job visibility after upgrade, and confirm that non-admin users no longer see jobs owned by other users.

3. Long-term hardening

   • Enforce least privilege across all Splunk roles and avoid granting broad search capabilities beyond operational need.
   • Centralize audit logging (search, REST access, authentication) and monitor for cross-user data access patterns as a standing detection.
   • Adopt a vulnerability management process that tracks Splunk Enterprise releases and monitors NVD and vendor advisories for CVE-2026-76275 updates, especially once patch confidence increases beyond 0/4.
   • Segment production SIEM infrastructure from general corporate networks to reduce the likelihood that a low-privileged foothold elsewhere escalates into SIEM metadata reconnaissance.

References

• NVD — CVE-2026-76275: https://nvd.nist.gov/vuln/detail/CVE-2026-76275
• MITRE ATT&CK — T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• MITRE CWE — CWE-285 Improper Authorization: https://cwe.mitre.org/data/definitions/285.html
• FIRST EPSS — CVE-2026-76275 score lookup: https://api.first.org/data/v1/epss?cve=CVE-2026-76275
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-76275 is NOT listed as of writing)

No public PoC, exploit code, or Nuclei template is available for this CVE. There is no evidence of exploit-in-the-wild activity, threat actor campaign association, or CISA KEV inclusion at this time.