CVE-2026-76290 json
Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise
published 2026-10-21 18 d ago modified 2026-10-30 9 d ago also EUVD-2026-107661
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding. The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request. After upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).
Patch / fix
- Splunk Splunk Enterprise 10.0.11, 10.2.8, 10.4.4
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 d ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Splunk Splunk Enterprise
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
advisory.splunk.com
/advisories/SVD-2026-1007
vendor-advisory, mitigation
Sources
- CVE List CVE-2026-76290
- NVD CVE-2026-76290
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.