# CVE-2026-76287: Splunk Enterprise authorization bypass in Data Management REST API

Source: https://junglewise.ai/threats/cve-2026-76287-in-splunk-enterprise-versions-below-10-4-4-a-user-that-holds-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-76287 · Severity: medium · CVSS 5.4 · Published 2026-10-21

Splunk Enterprise, a widely-used log and data analytics platform, contains a flaw in its Data Management REST API that allows users with specific data pipeline roles to read or delete data preview jobs belonging to other users. An attacker with these roles could access sensitive data or disrupt data pipeline previews. This vulnerability only affects instances where the Edge Processor feature has been explicitly enabled, which is disabled by default.

Technologies: [Splunk Enterprise](https://junglewise.ai/threats/technologies/splunk-enterprise). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-76287 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76287 being exploited in the wild.

**How severe is CVE-2026-76287?** Medium severity, with a CVSS score of 5.4, published 21 October 2026.

**Which products and versions are affected?** Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, 9.4.16.

**Is there a fix for CVE-2026-76287?** Yes: fixed in Enterprise 10.4.4, 10.2.8, 10.0.11, 9.4.16. Until then: Turn off the SPL2 preview sidecar by setting spl2_preview_enabled to false in the server.conf configuration file if Edge Processor SPL2 previews are not needed, then restart Splunk Enterprise. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76287 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76287?** Check whether you run Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Enterprise 10.4.4, 10.2.8, 10.0.11, 9.4.16

Turn off the SPL2 preview sidecar by setting spl2_preview_enabled to false in the server.conf configuration file if Edge Processor SPL2 previews are not needed, then restart Splunk Enterprise.

## Technical details

The Data Management REST API verifies that a user holds the preview_data_management_pipeline or edit_data_management_pipeline_job capability but fails to verify ownership of the requested SPL2 preview job before allowing read or delete operations. An authenticated user with the required capability can exploit this via network access to perform unauthorized data access or deletion. The flaw is mitigated by default because the Edge Processor feature, which exposes this API, is disabled by default.

## Affected products

- Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, 9.4.16

## Timeline

- 2026-10-21: disclosed

## References

- [https://advisory.splunk.com/advisories/SVD-2026-1007](https://advisory.splunk.com/advisories/SVD-2026-1007)

## Related threats

- [Splunk Enterprise improper neutralization vulnerability](https://junglewise.ai/threats/cve-2026-76302-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise protection mechanism failure](https://junglewise.ai/threats/cve-2026-76301-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise improper resource control](https://junglewise.ai/threats/cve-2026-76300-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise improper access control](https://junglewise.ai/threats/cve-2026-76299-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise hardcoded cryptographic key in PostgreSQL sidecar](https://junglewise.ai/threats/cve-2026-76298-in-splunk-enterprise-versions-below-10-4-4-and-10-2-8-a-user-who)