CVE-2026-76278

Executive Summary

CVE-2026-76278 is an authorization bypass (CWE-639) in Splunk Enterprise that allows an authenticated user holding a role with the edit_spl2_module_permissions capability to retrieve permission grants for SPL2 modules they are not authorized to view. The affected REST API fails to verify that the requesting user can read the targeted app before returning SPL2 module permission data. Successful exploitation discloses access-control metadata (which users/roles hold which module permissions) but does not by itself grant code execution, data modification, or privilege escalation; CVSS v3.1 base score is 4.3 (Low), reflecting limited confidentiality impact.

Technical Analysis

The vulnerability resides in a Representational State Transfer (REST) API responsible for exposing SPL2 module permission grants. Per the NVD description, the root cause is a missing authorization check: Splunk Enterprise "does not verify that the user can read the requested app before the affected REST API returns SPL2 module permission grants."

This is a classic case of CWE-639 (Authorization Bypass Through User-Controlled Key). The application trusts an object reference (here, the target app/module context supplied to the API) and returns data associated with that reference without re-validating the caller's read entitlement on the referenced object. The result is an horizontal information disclosure: a low-privileged user — one who merely possesses the edit_spl2_module_permissions capability — can enumerate permission grants belonging to apps and modules outside their authorized scope.

Attack surface characteristics:

• Vector: Network (AV:N). The REST API is reachable over HTTP(S).
• Authentication: Required. The attacker must hold a valid account with a role carrying edit_spl2_module_permissions (PR:L). The capability itself is a module-administration permission, not an elevated/system capability, so the affected population is any Splunk user whose role was granted module-permission editing rights.
• Complexity: Low (AC:L). No race condition, no special preconditions beyond the capability.
• User interaction: None (UI:N).
• Scope: Unchanged (S:U) — impact stays within the Splunk authorization boundary.

What is disclosed: the permission grants for SPL2 modules — i.e., which principals hold access to which modules. This is metadata about the access-control model, not the module contents or the underlying indexed data. The authorization flaw is specifically about the missing app-read verification step prior to the API emitting the grant listing.

The affected branches are Splunk Enterprise before 10.4.3, before 10.2.7, and before 10.0.10. The 9.4.x line is explicitly stated to be unaffected, meaning the vulnerable SPL2 module-permission REST surface was introduced or altered in the 10.x line. No public PoC, exploit code, or Nuclei template is available; the technical mechanics above are derived solely from the NVD description and the associated CWE classification.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (authorization bypass via missing object-level read check). Only artifacts named in the NVD description — the edit_spl2_module_permissions capability, the REST API, and SPL2 module permission grants — are referenced. No endpoints, parameter names, or function names beyond those are asserted.

1. Reconnaissance / target identification. The attacker requires an authenticated Splunk account whose assigned role includes the edit_spl2_module_permissions capability. In many deployments this is granted to search developers, knowledge managers, or platform operators — a broad, semi-trusted population. The attacker identifies the platform as Splunk Enterprise and confirms a vulnerable branch (10.0.x < 10.0.10, 10.2.x < 10.2.7, or 10.4.x < 10.4.3) via authenticated version introspection or banner information.

2. Triggering the flaw class. The attacker issues requests to the affected REST API with references to apps they are not entitled to read. Because the service does not verify the caller's read permission on the app before returning SPL2 module permission grants, the authorization check is effectively skipped. This is an object-reference authorization bypass (CWE-639): the caller controls the target app reference, and the server acts on it without validating the caller↔object relationship.

3. Payload / execution method (class level). The "payload" is simply a crafted, authenticated API request pointing at an out-of-scope app/module. No memory corruption, injection payload, or file write is involved — the exploitation primitive is a legitimate API call made against a target the caller should not be able to read. The attacker iterates over probable app/module references to harvest grant listings. Because the request is well-formed and uses the caller's own valid session, it blends into normal administrative API traffic.

4. Post-exploitation impact. The attacker obtains SPL2 module permission grants belonging to unauthorized apps. This reveals the access-control topology of the environment: which accounts and roles hold which module permissions. That information is valuable intelligence for subsequent lateral movement, privilege-target selection, or social engineering — it identifies high-value principals and the modules worth attacking — but it does not directly yield module contents, indexed data, or code execution. The attack does not modify state (no integrity impact) and does not degrade availability.

Nuclei template: NO. Exploit code: NO. CISA KEV: NO. EPSS 0.00162 (≈4.8th percentile) indicates very low near-term exploitation likelihood at time of assessment.

Impact Assessment

The CVSS v3.1 base score is 4.3 (Low), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Subscore breakdown:

• Confidentiality: Low (C:L). The disclosure is limited to permission-grant metadata for SPL2 modules. It exposes who-can-access-what, not the protected module contents themselves, which caps the confidentiality impact at Low.
• Integrity: None (I:N). The API read path returns data; it does not alter permission grants or module definitions.
• Availability: None (A:N). No denial-of-service or resource-exhaustion characteristic.
• Privileges Required: Low (PR:L). Exploitation demands an authenticated principal holding edit_spl2_module_permissions. This bypasses the normal expectation that module-permission viewers are themselves authorized on the target app, but does not require admin rights.
• Scope: Unchanged (S:U) and Attack Complexity: Low (AC:L) — the flaw is deterministic and reachable over the network.

Business impact. The primary risk is internal information disclosure that weakens the security posture of a Splunk deployment. Splunk frequently ingests sensitive operational, security, and business telemetry; knowing the SPL2 module permission map can reveal organizational structure, role design, and which modules are considered sensitive — an attractive reconnaissance input for an insider or a post-compromise attacker. Because the attacker is already authenticated, the finding is most relevant to insider-threat and lateral-movement modeling rather than mass external exploitation.

Blast radius. Any Splunk Enterprise 10.0.x, 10.2.x, or 10.4.x deployment below the fixed maintenance levels where a role carries the edit_spl2_module_permissions capability. Environments that have tightly scoped this capability to a small, trusted administrator group have a materially reduced exposure surface. The 9.4.x branch is not affected per the vendor, narrowing the affected fleet. No wormable or self-propagating behavior is implied by the available data.

Detection Guidance

Sigma Rule

title: Splunk SPL2 Module Permission Grants Access - Authorization Bypass (CVE-2026-76278)
id: 8b2c9f41-7d3a-4e6b-9c15-cve202676278
status: experimental
description: Detects authenticated REST API access to SPL2 module permission grants by users
  lacking read permission on the referenced app (CWE-639). Logic is behavioral/inferred;
  no public PoC exists for CVE-2026-76278.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76278
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1213
  - cve.2026.76278
logsource:
  product: splunk
  service: audit
detection:
  selection_action:
    action|contains:
      - 'spl2'
      - 'module_permission'
  selection_user:
    user|endswith:
      - '_spl2'
  filter_authorized:
    app_authorized: 'true'
  condition: selection_action and not filter_authorized
falsepositives:
  - Legitimate module-permission administrators auditing their own apps
level: low

YARA Rule

rule CVE_2026_76278_Splunk_SPL2_Module_Permission_Bypass
{
    meta:
        author = "valtersit.com"
        description = "Detects references to SPL2 module permission API access patterns consistent with CVE-2026-76278 authorization bypass in Splunk Enterprise audit/log artifacts."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76278"
        cve = "CVE-2026-76278"
        date = "2026-01-01"
    strings:
        $cap = "edit_spl2_module_permissions" ascii wide nocase
        $api1 = "module_permission" ascii wide nocase
        $api2 = "spl2" ascii wide nocase
        $rest = "/services/" ascii wide nocase
    condition:
        uint16(0) == 0x0A0D or true and
        ($cap or ($api2 and $api1)) and $rest
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76278 Splunk SPL2 Module Permission Grant Disclosure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"spl2"; nocase; content:"module"; nocase; content:"permission"; nocase; http.header; content:"Authorization"; nocase; classtype:attempted-recon; reference:cve,2026-76278; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76278; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202676278; rev:1;)

Elastic Detection

// EQL: correlate authenticated SPL2 module permission API access by low-privilege users
sequence by user.name with maxspan=5m
  [ any where process.name != null and
      stringContains(toLower(network.protocol), "http") and
      stringContains(toLower(url.path), "spl2") and
      stringContains(toLower(url.path), "module_permission") and
      user.name != null ]

Splunk SPL Query

index=_audit action IN ("edit_spl2_module_permissions","spl2_module_permission","spl2_permission_view")
  OR (uri_path="*spl2*module*permission*")
| eval cap_holder=if(match('roles',"edit_spl2_module_permissions"),"yes","no")
| stats count values(uri_path) AS paths values(user) AS users values(app) AS apps by user, action
| where count > 5
| sort - count
| table user action paths apps users count

Wazuh OSSEC Rule

<group name="splunk,cve-2026-76278,">
  <rule id="202676278" level="6">
    <decoded_as>json</decoded_as>
    <field name="action">edit_spl2_module_permissions|spl2_module_permission</field>
    <description>CVE-2026-76278: Splunk SPL2 module permission grants accessed - potential authorization bypass (CWE-639)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
  <rule id="202676279" level="8">
    <decoded_as>json</decoded_as>
    <field name="uri_path">/services/spl2/.*module.*permission</field>
    <field name="app_authorized">false</field>
    <description>CVE-2026-76278: Authenticated access to SPL2 module permission grants for an app the user cannot read</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict the capability. Audit all roles and remove edit_spl2_module_permissions from any principal that does not strictly require it. Splunk's role-based access control centers on capabilities; the smaller the set of accounts holding this capability, the smaller the exploitable population.
   • Least privilege on apps. Enforce srchAppTypes/app-level read restrictions so that users cannot reference apps they should not see, curtailing the object references an attacker could enumerate even if the checks are missing server-side.
   • Network exposure. Ensure the Splunk management/REST interface is not internet-exposed; restrict it to trusted management networks and require TLS.
   • Monitoring. Enable and forward _audit logs to the SIEM and alert on SPL2 module-permission API access by non-administrative users (see Detection Guidance).

2. Patch/upgrade steps.

   • Upgrade Splunk Enterprise to 10.4.3, 10.2.7, or 10.0.10 (or later on each branch) per the NVD description, which states these versions resolve the missing app-read verification. Validate the upgrade against current configurations and re-test SPL2 module permission behavior post-upgrade.
   • The 9.4.x branch is not affected; there is no action required for that line.
   • Because no patch artifact is confirmed by any tracked source (0/4), verify the fixed version directly against Splunk's official advisory/release notes before closing the finding.

3. Long-term hardening.

   • Adopt an object-level authorization review process: require that every REST handler performing an object reference re-validates the caller's read entitlement before returning data (the failing control here).
   • Integrate Splunk role/capability assignments into a periodic access-review cycle; treat edit_spl2_module_permissions as a privileged capability.
   • Correlate Splunk audit events with identity data to detect unusual module-permission enumeration patterns.
   • Maintain an asset inventory of Splunk versions and subscribe to the vendor's security advisories to shorten the window between disclosure and upgrade.

References

• NVD — CVE-2026-76278: https://nvd.nist.gov/vuln/detail/CVE-2026-76278
• Splunk documentation — Module permissions: https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions
• Splunk documentation — Manage SPL2 modules: https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

Threat actor campaigns / exploit-in-the-wild: none reported. CISA KEV: NO. EPSS 0.00162 (≈4.8th percentile). No public PoC, Nuclei template, or exploit code observed at time of assessment.