Skip to content
VulniPulse
High8.1Splunk

High [CVE-2026-76354] Path Traversal through Search Head Clustering in Splunk Enterprise

This high-severity Splunk advisory covers CVE-2026-76354 affecting Splunk Enterprise.

CVE-2026-76354 Published Aug 19, 2026Updated by vendor Aug 19, 2026
Affected products & platforms
SplunkSplunk Enterprise
Open vendor advisory

Android app · Google Play

Monitor future Splunk CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Summary

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST) API request that deletes or temporarily overwrites files writable by the user account running Splunk Enterprise processes on a non-captain search head cluster member.

The vulnerability is possible because Search Head Clustering bundle replication does not validate the name of a replicated bundle file or neutralize NUL bytes before constructing the member bundle path.

For more information see About search head clustering ( ), Define roles on the Splunk platform with capabilities ( ), and Secure Splunk Enterprise service accounts ( ) in the Splunk documentation.

Affected versions
  • Splunk Enterprise 10.4 before 10.4.2
  • Splunk Enterprise 10.2 before 10.2.6
  • Splunk Enterprise 10.0 before 10.0.9
  • Splunk Enterprise 9.4 before 9.4.14

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Fixed versions
  • 10.4.2
  • 10.2.6
  • 10.0.9
  • 9.4.14

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Mitigation

Upgrade to a fixed release: 10.4.2, 10.2.6, 10.0.9, 9.4.14. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.