Detections
Analytics
Splunk Enterprise 10.0.0 < 10.0.10, 10.2.0 < 10.2.7, 10.4.0 < 10.4.3 (SVD-2026-1001)
medium Nessus Plugin ID 364457
Synopsis
An application running on a remote web server host is affected by multiple vulnerabilities.Description
The version of Splunk Enterprise installed on the remote host is 10.0.x prior to 10.0.10, 10.2.x prior to 10.2.7, or 10.4.x prior to 10.4.3. Splunk Enterprise 9.4.x is not affected. It is, therefore, affected by multiple vulnerabilities as referenced in the SVD-2026-1001 advisory, including:- A low-privileged user could cause a denial of service against a REST API endpoint in the Discover Splunk Observability Cloud app, because the app uses an inefficient regular expression to validate input.
(CVE-2026-76271)
- A user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud to an attacker-controlled host and disclose the configured Observability Cloud API token. (CVE-2026-76274)
- A user that holds a role with the read_o11y_content capability could inject forged entries into the Splunk App for Splunk O11y Cloud log through the REST API. (CVE-2026-76267)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade Splunk Enterprise to version 10.0.10, 10.2.7, 10.4.3, or later.See Also
Plugin Details
Severity: Medium
ID: 364457
File Name: splunk_1043_cve-2026-76271.nasl
Version: 1.1
Type: Combined
Agent: windows, macosx, unix
Family: CGI abuses
Published: 10/9/2026
Updated: 10/9/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.67
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C
CVSS Score Source: CVE-2026-76271
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability Information
CPE: cpe:/a:splunk:splunk
Required KB Items: installed_sw/Splunk
Patch Publication Date: 10/7/2026
Vulnerability Publication Date: 10/7/2026
Reference Information
CVE: CVE-2026-76267, CVE-2026-76271, CVE-2026-76274, CVE-2026-76276, CVE-2026-76278