Session Token Forging Vulnerability in Splunk Enterprise by Splunk
CVE-2026-76338

8.1HIGH

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76338?

In Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, there exists a vulnerability that allows an unauthenticated user with access to a trusted distributed search private key to forge an administrative session token. This situation can lead to unauthorized access to sensitive data, compromise system integrity, and disrupt the availability of services. The root cause lies in the distributed search authentication token endpoint, which fails to mandate a signed request for identifying a configured search peer. Instead, it falls back to using shared local key material, presenting a significant risk for organizations utilizing vulnerable versions of Splunk Enterprise.

Affected Version(s)

Splunk Enterprise 10.4 < 10.4.2

Splunk Enterprise 10.2 < 10.2.6

Splunk Enterprise 10.0 < 10.0.9

References

https://advisory.splunk.com/advisories/SVD-2026-0801

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.