Splunk Enterprise CVE-2026-76251

Three conditions must all be true: (1) Splunk Enterprise must be running a 10.x release below the fixed versions (10.4.2, 10.2.6, or 10.0.9) - Splunk 9.3 and 9.4 are explicitly exempt; (2) the Splunk App for Splunk Observability Cloud must be installed and configured with a valid Observability Cloud access token; (3) the attacker must hold a valid Splunk account that does NOT have the admin or power role - low-privileged authenticated access is both sufficient and required. Exploitation is limited to users who can authenticate to Splunk Enterprise at all, which bounds the threat to insider or post-initial-access scenarios. The CVSS PR:L confirms low-privileged authentication is required; PR:N (unauthenticated) is not applicable here.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N scores 7.1 (High), which reflects the real-world risk well. PR:L is accurate: any authenticated Splunk user, regardless of role, can trigger the flaw over the network with no additional conditions. C:H is appropriate because token exposure grants full read access to Observability Cloud data scoped to that token, which may include sensitive infrastructure metrics, traces, and logs. I:L reflects that limited write actions on Observability Cloud content are possible. There is no availability impact. EPSS data was not provided in the input, so exploitation probability cannot be numerically stated. No CISA KEV listing and no confirmed POC are present, which moderates operational urgency relative to the CVSS score. The realistic risk is elevated for organizations that have deployed the Observability Cloud integration with a broadly shared token, and for environments where low-privileged Splunk accounts are granted to a wide user base - a common pattern in SOC environments where analysts hold reader-level access. The vulnerability does not affect Splunk 9.3 or 9.4, narrowing the exposed population to the 10.x branch.

An authenticated Splunk user assigned a basic analyst or viewer role - deliberately excluded from admin and power roles - sends a crafted HTTP request to one of the Splunk App for Splunk Observability Cloud's REST API endpoints on the Splunk Enterprise server. The endpoint handler, lacking a capability gate, immediately proxies the request to Splunk Observability Cloud using the app's stored API access token, returning Observability Cloud data (dashboards, metrics, traces) to the attacker and allowing limited content modifications. No public exploit code has been confirmed, but the attack surface is straightforward for any user familiar with Splunk's internal REST API structure.