Vulnerability in Splunk Enterprise Affects Federated Search Functionality
CVE-2026-76297
4.2MEDIUM
What is CVE-2026-76297?
In specific versions of Splunk Enterprise, a vulnerability exists that allows an unauthenticated user to manipulate the actions of authenticated users who possess the edit_federated_providers capability. By phishing, the attacker can trick such users into sending requests that disable all federated search providers. This prevents federated searches from successfully accessing data from remote datasets, thereby affecting the functionality of the Splunk Enterprise platform.
Affected Version(s)
Splunk Enterprise 10.4 < 10.4.4
Splunk Enterprise 10.2 < 10.2.8
Splunk Enterprise 10.0 < 10.0.11