Authentication Bypass in Splunk Enterprise via Embedded Report Tokens

Splunk Enterprise contains a critical vulnerability (CVE-2026-76310) in versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that allows unauthenticated users to perform unauthorized actions. The issue stems from insufficient access control on the REST API, specifically concerning dispatch archive download requests for embedded reports. An attacker possessing an embedded report token can download the associated search job dispatch archive. By extracting session material from these archives, an attacker can impersonate the report owner. If the report owner is assigned the 'admin' role, the attacker can leverage these hijacked credentials to perform full administrative actions within the Splunk environment, compromising system integrity and accessing restricted data. This vulnerability highlights the importance of restricting embedded report access and properly configuring role-based access control.

Impact

Successful exploitation allows unauthenticated attackers to gain the privileges of a report owner. If the owner has administrative rights, the attacker can achieve full administrative control over the Splunk instance, leading to unauthorized data exfiltration, modification of search configurations, and potential persistence mechanisms within the platform.

Recommendation

• Upgrade all Splunk Enterprise instances to version 10.4.2, 10.2.6, 10.0.9, 9.4.14 or later immediately to patch CVE-2026-76310.
• Review and restrict access to embedded reports as documented in the Splunk Enterprise Reporting Manual.
• Conduct a security audit of current role-based user access configurations to ensure that 'admin' level permissions are limited to the minimum number of users required.
• Monitor REST API logs for anomalous download requests involving dispatch archives originating from non-authenticated or external sources.