CVE-2026-76317
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could move files that the user account running Splunk Enterprise can read into a lookup that the user controls. The user could then access all relevant data and affect system integrity and availability on the search head. The vulnerability is possible because the lookup configuration endpoint does not resolve lookup source paths before checking whether they stay inside the allowed lookup staging area. For more information see About lookups (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.4/use-lookups-in-splunk-web/about-lookups) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.39%
- CWE
- CWE-26
- Published
- 2026-08-19
- Last modified
- 2026-08-27
Affected products
- Splunk Splunk Enterprise
- Splunk Splunk Enterprise
- Splunk Splunk Enterprise
- Splunk Splunk Enterprise
Weakness type
Related vulnerabilities
- CVE-2026-46747 — A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected...
- CVE-2026-42196 — django-s3file: Relative path traversal
- CVE-2026-25575 — NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionality
- CVE-2025-53908 — RomM vulnerable to Authenticated Path Traversal
- CVE-2025-25295 — Label Studio has a Path Traversal Vulnerability via image Field
- CVE-2024-5866 — Arbitrary Directory Listing in Centrify PAS
- CVE-2024-5865 — Arbitrary File Reading in Centrify PAS
- CVE-2024-20345 — A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an...