CVE-2026-76267
Medium
Description
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log. Splunk Enterprise versions 9.4.x are not affected.
SeverityMedium
CVSS4.3
Exploit probability—
ProductSplunk
PublishedOct 7, 2026
First seenOct 7, 2026
Weakness typeCWE-117CWE-117
How to fix
Update
- splunk splunk10.0.10, 10.2.7, 10.4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| splunk splunk | 10.0.0 ≤ v < 10.0.10, 10.2.0 ≤ v < 10.2.7, 10.4.0 ≤ v < 10.4.3 | 10.0.10, 10.2.7, 10.4.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.