{
  "id": 14881908,
  "title": "CVE-2026-76269: Improper Access Control in Splunk Enterprise REST Search Job Retrieval",
  "url": "https://urgent.news/2026/10/16/cve-2026-76269-improper-access-control-in-splunk-enterprise-rest",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-16T06:00:45.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/onaeiuspkz/cve-2026-76269-improper-access-control-in-splunk-enterprise-rest-search-job-retrieval-bh5"
  },
  "original_language": "en",
  "account": "CVE-2026-76269 is a security flaw affecting Splunk Enterprise that allows unauthorized access to search job results through the REST API. This vulnerability, classified under CWE-639, stems from an improper authorization check, enabling users to access job artefacts belonging to others when the key or identifier in a retrieval request falls under their control. Splunk addressed the issue in October 2026's security patch, which encompassed 22 vulnerabilities across Splunk Enterprise 10.4, 10.2, and 10.0 branches, with fixes released as advisories SVD-2026-1001 and SVD-2026-1002. No known public exploits exist for this batch. The impact of this flaw is significant, as search jobs typically contain raw event data from various indexes, which, when accessed by unauthorized users, can expose sensitive information such as security telemetry, application records, and personal data subject to regulatory regulations. Unlike memory corruption issues, this flaw is more stealthy, with no crash or noticeable operational trace upon successful exploitation. Affected versions span from 9.4.0 to 10.4.2, with patches available in subsequent releases. While ZoomEye reports 114,213 and 47,630 instances for Splunk Enterprise and Splunk respectively, these counts represent internet-reachable deployments. Remediating this vulnerability involves installing the latest branch release and reviewing role assignments, as even patched servers may still grant access based on the current permission model. Administrators should also audit REST access tokens, retire unused service accounts, and monitor search job retrieval patterns for anomalies.",
  "summary": "CVE-2026-76269: Improper Access Control in Splunk Enterprise REST Search Job Retrieval Vulnerability overview CVE-2026-76269 is rated 6.5 and classified as CWE-639, Authorization Bypass Through User-Controlled Key. It concerns how search jobs are retrieved through the Splunk Enterprise REST API. Splunk issued the fix across the 10.4, 10.2 and 10.0 branches as part of its October 2026 batch, which…",
  "key_points": [
    "Unauthorized access to search job results via Splunk Enterprise REST API",
    "CWE-639: Improper authorization check enabling job artefact access",
    "Patches released in October 2026 security advisories SVD-2026-1001 and SVD-2026-1002"
  ],
  "editors_take": "This improper access control vulnerability turns the REST API into a silent gateway for unauthorized users to harvest sensitive telemetry and personal data without triggering operational alarms.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}