Remote Code Execution Vulnerability in Splunk Enterprise by Splunk

CVE-2026-76345

What is CVE-2026-76345?

A security flaw exists in Splunk Enterprise versions prior to 10.4.2, where a user with elevated privileges can exploit the search head cluster member bundle REST API. This vulnerability allows the unauthorized writing of files to locations accessible by the Splunk user account, potentially leading to remote code execution. Such exploitation may compromise the availability and integrity of the entire Splunk deployment. The root cause stems from insufficient authorization checks and a lack of validation on bundle paths in the REST API. For further insights, refer to the official Splunk documentation.

References