EUVD-2026-36084
GHSA-jhf8-vwfv-vr95
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds a Splunk role that contains the high-privilege capability edit_saved_search_owner could reassign saved search ownership to users outside their authorized scope. The ownership reassignment endpoint lacks access control.
AnalysisAI
Improper access control on the saved search ownership reassignment endpoint in Splunk Enterprise and Splunk Cloud Platform allows a highly privileged authenticated user - one whose role contains the edit_saved_search_owner capability - to reassign saved search ownership to users outside their authorized scope. Affected versions span Splunk Enterprise below 10.2.4 and 10.0.7, and multiple Splunk Cloud Platform branches below their respective fixed builds. No public exploit has been identified at time of analysis, and the PR:H CVSS requirement confines risk primarily to insider threats or scenarios involving compromised privileged Splunk accounts.
Technical ContextAI
The vulnerability is rooted in CWE-284 (Improper Access Control), where the API endpoint responsible for reassigning saved search ownership in Splunk fails to enforce authorization scope boundaries. Splunk's role-based access control model grants specific capabilities to roles; the edit_saved_search_owner capability is designated high-privilege and enables modification of saved search ownership metadata. The flaw is that while the capability gate controls who can invoke the endpoint, no secondary check validates whether the target reassignment user falls within the invoking user's permitted scope. Both Splunk Enterprise (CPE: cpe:2.3:a:splunk:splunk_enterprise) and Splunk Cloud Platform (CPE: cpe:2.3:a:splunk:splunk_cloud_platform) share this endpoint logic and are affected across a broad range of versions. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N confirms this is a network-accessible, low-complexity flaw with high confidentiality impact once the privilege threshold is met.
RemediationAI
Upgrade Splunk Enterprise to version 10.2.4 or 10.0.7 (the fixed releases per the vendor advisory SVD-2026-0609 at https://advisory.splunk.com/advisories/SVD-2026-0609). For Splunk Cloud Platform, upgrade to the fixed build corresponding to your active branch: 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, or 9.3.2411.131. As a compensating control where immediate patching is not possible, audit all Splunk roles that contain the edit_saved_search_owner capability and remove it from any role where it is not operationally required - this directly eliminates the attack surface by reducing the population of users who can invoke the vulnerable endpoint. Note that removing the capability may affect legitimate ownership management workflows and should be coordinated with Splunk administrators. No additional workaround details were provided in the vendor advisory at time of analysis.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today