Data Management Vulnerability in Splunk Enterprise by Splunk
CVE-2026-76287

5.4MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Vendor
CVE Published:
21 October 2026

What is CVE-2026-76287?

In Splunk Enterprise prior to version 10.4.4, users with certain roles, such as those holding the preview_data_management_pipeline or edit_data_management_pipeline_job capabilities, may unintentionally gain access to Data Management SPL2 preview jobs associated with other users. This occurs due to the Data Management REST API's insufficient verification process for ownership when handling preview jobs. Consequently, this flaw could allow unauthorized actions, such as reading or deleting preview jobs outside of their permission scope. Note that this API is only accessible when the Edge Processor feature is enabled, which is not activated by default.

Affected Version(s)

Splunk Enterprise 10.4 < 10.4.4

References

https://advisory.splunk.com/advisories/SVD-2026-1007

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

oxship
.