Privilege Escalation in Splunk Enterprise Versions by Splunk

CVE-2026-76298

What is CVE-2026-76298?

In Splunk Enterprise versions prior to 10.4.4 and 10.2.8, a security flaw allows users without 'admin' or 'power' roles to exploit a weakness in the PostgreSQL sidecar service. This oversight enables these users to extract the superuser database password derived from the search head cluster identifier, which may be present in search job logs. Consequently, affected users can execute arbitrary operating system commands under the permissions of the Splunk user account on search head cluster members. Proper role-based access controls and configuration settings should be reviewed and strengthened to mitigate this risk.

References