Summary
CVE-2026-76338 is an improper authentication vulnerability (CWE-287) affecting Splunk Enterprise. An unauthenticated attacker with access to a trusted distributed search private key can forge an administrative session token via the REST API’s distributed search authentication endpoint. The issue carries a CVSS v3.1 base score of 8.1 (High) and can lead to full compromise of confidentiality, integrity, and availability.
Technical details
- Root cause: The distributed search authentication token endpoint does not require a signed request to identify a configured search peer, and instead falls back to shared local cryptographic key material.
- Trigger condition: An attacker must have access to a trusted distributed search private key; no valid Splunk user credentials or session are otherwise required.
- Attack vector: Network (AV:N), high attack complexity (AC:H), no privileges required (PR:N), no user interaction (UI:N).
- Impact: Successful exploitation allows forging an administrative session token, which can be used to access all relevant data, alter system integrity, and disrupt service availability (C:H/I:H/A:H).
Affected software
- Splunk Enterprise 10.4.x — versions below 10.4.2
- Splunk Enterprise 10.2.x — versions below 10.2.6
- Splunk Enterprise 10.0.x — versions below 10.0.9
- Splunk Enterprise 9.4.x — versions below 9.4.14
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later, matching the affected release line.
- If patching is not immediately possible: Set
strictPeerNameValidation = trueinauthentication.confon every node in the distributed search deployment, then restart Splunk Enterprise services on all affected nodes to apply the change.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw response body: a footer line reading
© 2026 Splunk Inc., optionally followed bySplunk [version].

