CVE-2026-76279

Executive Summary

CVE-2026-76279 is an input validation / improper normalization vulnerability (CWE-20) in Splunk Enterprise that allows an authenticated user holding a role with the run_collect capability to write events to internal indexes outside the index access configured for that role. The flaw exists because Splunk Enterprise does not normalize whitespace in an index name before applying the configured index-access restrictions, so a crafted index name bypasses role-based index access controls. Although rated only 4.3 (LOW) on the CVSS v3.1 scale, the issue is a security-control bypass that undermines index-level data isolation, which is material for organizations that rely on Splunk index access as a data segregation boundary (multi-tenant SOCs, MSSPs, regulated data separation).

Technical Analysis

Splunk Enterprise role-based access control (RBAC) governs which users can search and write to which indexes. One of the capabilities that can be granted to a role is run_collect, which permits execution of the collect Search Processing Language (SPL) command. The collect command is designed to place the results of a search into a specified index (commonly an internal or summary index) rather than merely returning them to the user.

The vulnerability is a classic normalization mismatch. Per the NVD description, Splunk Enterprise "does not normalize whitespace in an index name before applying configured index-access restrictions for the role." In other words, the string the platform uses to validate whether the user is authorized to write to a given index is not normalized in the same way as the string that is ultimately used to route the event to the target index. When the index-access check and the index-routing logic disagree about the canonical form of an index name (for example, because of embedded or alternate whitespace in the supplied name), the authorization decision can be evaluated against a different index than the one the event is actually written to.

The result is a write-side index access control bypass. The user does not gain read access to the target index, does not gain elevated privileges, and does not execute arbitrary code. What the user gains is the ability to insert attacker-controlled events into internal indexes that their role explicitly does not permit them to write to. Because index names are resolved server-side and the check is not normalized, the defect is entirely within Splunk's role-enforcement path rather than an external component.

The affected attack surface is the Splunk search/processing endpoint used to execute SPL, specifically any authenticated session whose role includes the run_collect capability. No special UI interaction is required (UI:N), the attack is network-reachable (AV:N), and the required precondition is a valid low-privileged account (PR:L). The scope is unchanged (S:U): the impact is confined to integrity of data stored in indexes the role should not be able to write to.

Because no public PoC, exploit code, or Nuclei template is available, specific payload strings and the exact whitespace form required to trigger the mismatch are not published. The vulnerability class (authorization check performed on a non-normalized identifier) and the affected command (collect) are precisely defined by the vendor description, but the exact index-name encoding that defeats normalization should not be fabricated and is not publicly documented.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-20 normalization/validation failure in an RBAC enforcement path) and the vendor description.

1. Reconnaissance / target identification. The attacker obtains a valid, low-privileged Splunk account whose role is granted the run_collect capability. This is common in environments where analysts, automation service accounts, or delegated SOC roles are allowed to persist search results into summary/index-adjacent indexes. The attacker enumerates the indexes that exist (names are typically discoverable via search metadata and role configuration surfaces) and identifies internal indexes they are not authorized to write to.

2. Triggering the flaw class. Using the SPL search interface, the attacker invokes the collect command and supplies an index name that is semantically identical to a restricted internal index but not normalized identically — e.g., an index name containing alternate or embedded whitespace. Splunk's role enforcement evaluates the configured index-access restriction against the un-normalized name, while the indexing path resolves and writes the event to the intended (restricted) index. The net effect is that the authorization check passes for one effective index while the event lands in another.

3. Execution method (vulnerability-class level). The action is a legitimate, authenticated search execution. There is no memory corruption, no remote code execution, and no privilege escalation. The attacker simply directs collect output to a target index using a name form that evades the role's index filter. Because collect is a first-class search command, the request traverses the normal Splunk search pipeline and management endpoints; it will appear in search job telemetry as an ordinary collect operation.

4. Post-exploitation impact. The attacker achieves unauthorized writes into internal indexes. This can degrade the integrity and trustworthiness of internal telemetry, pollute audit-evidence indexes, contaminate summary/accelerated data used by downstream dashboards and detection rules, and — where index boundaries are used as a compliance/tenant separation control — violate that separation. Depending on what consumes the target internal index, injected events could influence alerting, reporting, or investigations. Confidentiality is not directly affected (no read access is obtained), and there is no direct availability impact, consistent with the CVSS vector (C:N/I:L/A:N).

Impact Assessment

The CVSS v3.1 base score is 4.3 (LOW) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. This reflects: network-reachable attack surface (AV:N), no special conditions beyond a valid account (AC:L), a low-privileged authenticated requirement (PR:L), no user interaction (UI:N), scope unchanged (S:U), no confidentiality impact (C:N), a partial integrity impact (I:L), and no availability impact (A:N).

Business impact is concentrated in data-integrity and control-integrity rather than direct compromise. The vulnerability defeats the intended guarantee that a role's index-access configuration limits where that role can write. For most single-tenant, internal SOC deployments the practical risk is moderate: a trusted analyst could quietly corrupt internal index content. For MSSPs, multi-tenant Splunk deployments, and organizations using index access to segregate regulated or crown-jewel data, the same defect represents a breach of a security boundary and can carry compliance consequences.

Blast radius is bounded by the number of accounts with the run_collect capability and by the set of internal indexes a given role cannot otherwise write to. EPSS is 0.00166 (5.3rd percentile), and the CVE is not in CISA KEV, so near-term exploitation likelihood by commodity adversaries is low. The absence of public exploit code further lowers opportunistic risk. The primary threat is a malicious or careless insider, or an attacker who has already obtained a low-privileged Splunk credential and wishes to manipulate internal telemetry to obscure activity or poison detections. Affected systems are Splunk Enterprise instances at versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15.

Detection Guidance

Detection should focus on anomalous collect usage and on writes to internal indexes originating from roles that should not be able to write to them. Because the exploit abuses a legitimate command with a non-normalized index name, the strongest signals are deviations from normal index naming and unusual collect destinations.

Sigma Rule

title: Splunk Collect Command Writing to Unexpected or Non-Normalized Index
id: 6a7c1f2e-3b9d-4c6a-9f2b-762790000001
status: experimental
description: Detects use of the SPL collect command targeting internal indexes, especially with index names containing irregular whitespace or non-standard characters, indicating possible index access control bypass (CVE-2026-76279).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76279
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: splunk
  service: audit
detection:
  selection_command:
    search_name|contains:
      - '| collect'
      - '|collect'
  selection_index:
    index|contains: 'index='
  filter_known_good:
    user|endswith: '_svc_collect'
  condition: selection_command and selection_index and not filter_known_good
fields:
  - user
  - index
  - search_name
  - src_ip
falsepositives:
  - Legitimate summary indexing jobs
  - Authorized collect workflows to approved internal indexes
level: medium
tags:
  - attack.t1078
  - cve.2026-76279

YARA Rule

rule CVE_2026_76279_Splunk_Collect_Index_Bypass
{
    meta:
        author      = "Threat Intelligence"
        description = "Detects SPL collect invocations referencing internal indexes with irregular whitespace, indicative of CVE-2026-76279 index access bypass"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-76279"
        date        = "2026-01-01"
        score       = 60

    strings:
        $collect1 = "| collect" ascii nocase
        $collect2 = "|collect" ascii nocase
        $idx1     = "collect index=" ascii nocase
        $idx2     = "collect index =" ascii nocase
        $internal = "index=_internal" ascii nocase
        $audit    = "index=_audit" ascii nocase

    condition:
        (any of ($collect*)) and (any of ($idx*)) and (any of ($internal, $audit))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76279 Possible Splunk collect Index Access Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/services/search/jobs"; http.request_body; content:"collect"; nocase; http.request_body; content:"index="; nocase; pcre:"/collect\s+index\s*=\s*[^&\s]*\s+[^&\s]*/i"; reference:cve,2026-76279; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76279; classtype:attempted-user; sid:9076279; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" and user.name != null ]
  [ any where event.category == "web" and
      process.command_line != null and
      process.command_line : "*collect*" and
      process.command_line : "*index=*" ]

Splunk SPL Query

index=_audit action=search info=completed search="*| collect*" OR search="*|collect*"
| rex field=search "collect\s+index\s*=\s*\"?(?<target_index>[^\s\"]+)"
| where match(target_index, "^_") OR match(target_index, "\s")
| stats count values(search) as searches values(target_index) as target_indexes by user, src, role
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="splunk,cve-2026-76279,">
  <rule id="100762" level="10">
    <decoded_as>json</decoded_as>
    <field name="search">\| ?collect</field>
    <field name="index">index\s*=</field>
    <description>CVE-2026-76279: Possible Splunk collect command targeting internal index - index access bypass attempt</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_76279,</group>
  </rule>

  <rule id="100763" level="12">
    <if_sid>100762</if_sid>
    <field name="target_index">^_</field>
    <description>CVE-2026-76279: collect command writing to internal index (_-prefixed) - high confidence index access bypass</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_76279,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no vendor fix currently evidenced):

• Restrict the run_collect capability. Remove it from roles that do not strictly require it. The vulnerability is only reachable by users whose role holds run_collect; eliminating that capability from untrusted or broad roles removes the attack surface entirely for those accounts.
• Apply least privilege aggressively: audit which roles carry run_collect and confirm each is justified. Service accounts and analyst roles are the highest-priority candidates for review.
• Tighten index write authorization. Where your Splunk version permits, restrict collect targets explicitly and monitor/alert on collect writes to internal _-prefixed indexes.
• Increase audit coverage: ensure audit logging is enabled and search activity is forwarded to a tamper-resistant destination so that attempts (and successful bypasses) are captured.
• Isolate tenants: for MSSP/multi-tenant or regulated deployments, avoid relying solely on Splunk index access as the segregation boundary until the normalization defect is resolved; add compensating monitoring.

2. Patch / upgrade steps:

• Upgrade Splunk Enterprise to 10.4.3, 10.2.7, 10.0.10, or 9.4.15 (or later), which per the vendor description are the versions above the affected range. Because no tracked source currently provides patch evidence, confirm fixes against the vendor's official release notes and advisories before relying on them, and stage upgrades in a test environment first (indexers, search heads, and forwarders as applicable to the affected components).
• After upgrading, validate that the role-based index-access restriction now normalizes whitespace and correctly blocks collect writes to unauthorized indexes.

3. Long-term hardening:

• Adopt a standing capability-review process so that powerful SPL capabilities (run_collect and similar) are granted only to narrowly scoped roles and are reviewed on a schedule.
• Implement continuous detection (see Detection Guidance) rather than one-time review, so future normalization/authorization regressions in search commands are caught early.
• Maintain asset and version inventory for all Splunk components to shorten exposure windows for future advisories.
• Feed Splunk vendor advisories into your vulnerability management workflow (this CVE shows the value of tracking vendor-specific CNA output, since third-party feeds may lag).

References

• NVD — CVE-2026-76279: https://nvd.nist.gov/vuln/detail/CVE-2026-76279
• Splunk Docs — collect search command: https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect
• Splunk Docs — Define roles with capabilities: https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities
• Splunk Docs — How indexing works: https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.4/indexing-overview/how-indexing-works
• CISA Known Exploited Vulnerabilities catalog (CVE not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild: no public PoC, exploit code, or Nuclei template is available for CVE-2026-76279, and the CVE is not listed in CISA KEV. There is no known threat actor campaign associated with this vulnerability at the time of writing. EPSS is 0.00166 (5.3rd percentile), indicating low near-term exploitation probability.