Splunk Enterprise: Scheduled search SPL command safeguard bypass (CVE-2026-76291)

Splunk Enterprise contains a vulnerability where the search scheduler fails to apply Search Processing Language (SPL) safeguards to scheduled searches. An authenticated user possessing the 'schedule_search' capability can leverage this flaw to execute restricted or risky SPL commands that would otherwise be blocked. This vulnerability allows for unauthorized disclosure or modification of data stored within the Splunk platform, as well as potential service disruption.

Impact

Successful exploitation allows an authenticated user with existing scheduled search permissions to execute restricted SPL commands, potentially leading to unauthorized data access, data alteration, or denial-of-service conditions within the Splunk environment.

Recommendation

• Upgrade Splunk Enterprise to version 10.4.4, 10.2.8, 10.0.11, 9.4.16, or later to address the scheduler safeguard flaw.
• Review and audit existing scheduled searches for users with the 'schedule_search' capability.
• Apply the principle of least privilege by restricting the 'schedule_search' capability to only those users and service accounts that strictly require it for operational duties.
• Refer to the official Splunk 'SPL safeguards for risky commands' documentation to identify and restrict high-risk commands within your environment.