CVE-2026-76297: Splunk Enterprise federated search provider CSRF state change

CVE-2026-76297 · Severity: medium · CVSS 4.2 · Published 2026-10-21

Splunk Enterprise allows users to configure federated searches to retrieve data from remote Splunk deployments. An attacker can trick an administrator into visiting a malicious page that disables all federated search providers without the victim's knowledge, temporarily blocking access to remote data. This attack requires phishing the victim but could disrupt critical cross-site search operations.

Technologies: Splunk Enterprise. Vendors: Splunk.

Quick answers

Is CVE-2026-76297 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76297 being exploited in the wild.
How severe is CVE-2026-76297?
Medium severity, with a CVSS score of 4.2, published 21 October 2026.
Which products and versions are affected?
Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16.
Is there a fix for CVE-2026-76297?
Yes: fixed in Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, 9.4.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76297 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-76297?
Check whether you run Splunk Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, 9.4.16

Technical details

The federated provider REST API in Splunk Enterprise accepts GET requests for state-changing operations, violating REST conventions and enabling cross-site request forgery (CSRF) attacks. An unauthenticated attacker can craft a malicious URL or embed it in a webpage to trick an authenticated user holding the edit_federated_providers capability into disabling all federated search providers. The user's browser automatically sends their session credentials with the request, allowing the attacker to change system state without valid authorization.

Affected products

  • Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11, and 9.4.16

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.