Splunk Enterprise August 2026 hardening release (SVD-2026-0801): three unauthenticated CVSS 9.4 flaws let anyone holding an embedded-report token hijack the report owner's session, admins included
Splunk's SVD-2026-0801, published 2026-08-19, fixes 60 CVEs across Splunk Enterprise 10.4.0–10.4.1 (→10.4.2), 10.2.0–10.2.5 (→10.2.6), 10.0.0–10.0.8 (→10.0.9) and 9.4.0–9.4.13 (→9.4.14). The headline is a trio of unauthenticated CVSS 9.4 flaws (CWE-284, Improper Access Control) in Splunk's embedded-report feature: CVE-2026-76310 (Embedded Report REST API Requests), CVE-2026-76311 (Embedded Report Dispatch Archives) and CVE-2026-76312 (Embedded Reports generally). Splunk's own description of the mechanism is precise about the impact: "an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the 'admin' Splunk role" (Splunk, SVD-2026-0801, 2026-08-19). CVE-2026-76312's variant needs no token at all — reading the HTML source of any page that embeds a Splunk report is enough. Splunk's stated mitigation is allowEmbedTokenAuth = false in server.conf where embedding is unused, or turning off Splunk Web entirely for the -76312 variant.
Because Splunk is itself the SIEM many organisations run their own detection on, a session-hijack path into it is a path into the detection estate — an attacker who recovers an admin-owned embedded report's session material can act with that report owner's privileges inside the platform responders rely on to see everything else. That elevates this above an ordinary product-patch cycle regardless of Splunk's own severity framing.
Three further high-severity items round out the batch. CVE-2026-76350 (CVSS 8.8, CWE-269) lets any user holding only the schedule_search capability configure a PDF-attachment email-alert action that Splunk's scheduler then renders under a system-level authentication context rather than the action owner's: "a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges" (Splunk, SVD-2026-0801, 2026-08-19) — a low-privileged, schedule-only role escalating to system-wide data exposure. CVE-2026-76253 (also CVSS 8.8, CWE-269) is the same privilege class reaching further: a schedule_search-only role can run arbitrary SPL commands with the highest level of system privilege through scheduled-search alert-action configuration, because the search scheduler does not properly restrict user-specific alert-action settings before running them — "a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every credential stored in the credential store, which can allow for disclosure and modification of all relevant data and affect system integrity and availability" (Splunk, SVD-2026-0801, 2026-08-19). CVE-2026-76351 (CVSS 8.8) is an SSRF in the Secure Gateway Report Notification REST API reachable with only schedule-level privilege, minting a system-level session token with no password. Five further RCE-class CVEs (knowledge-bundle upload, Web Manager configuration XML evaluation, federated search) and a stored-credential-exposing SPL injection via the geostats command round out the release; none is reported exploited.
Detection concentrates on the two access paths Splunk itself names. For the embedded-report trio: audit which reports currently have embedding enabled and who owns them, and treat any dispatch-archive download request that does not originate from Splunk's own scheduler or an authenticated interactive session as suspect — legitimate embedded-report viewing never needs the underlying dispatch archive directly. Triage: a normal embedded-report view renders through the web tier and never touches the raw dispatch archive path; a request that goes straight for the archive, or that arrives with a token but no corresponding active browser session, is the discriminator. For CVE-2026-76350, review scheduled email-alert actions for PDF-attachment configuration owned by low-privileged accounts — the presence of that configuration on an account holding only schedule_search is itself the anomaly, since the feature's system-level execution context was not intended for that privilege level.
an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the "admin" Splunk role
a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges
a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every credential stored in the credential store, which can allow for disclosure and modification of all relevant data and affect system integrity and availability
Defender actions
- Patch Splunk Enterprise to 10.4.2 / 10.2.6 / 10.0.9 / 9.4.14 now, and in the interim set allowEmbedTokenAuth = false in server.conf on any instance where embedded reports are not actively used — the three CVSS 9.4 flaws are unauthenticated for anyone holding, or able to read the page HTML for, an embedded-report token, and the compromised session can carry admin privileges.
- Audit which reports and dashboards are currently embedded (via allowEmbedTokenAuth or a page exposing report HTML) and owned by an admin-role account — those are the highest-value targets for CVE-2026-76310/76311/76312 and should either be re-owned to a lower-privileged account or have embedding disabled first.
- Review every role holding only the schedule_search capability and, until patched, remove or restrict scheduled-search alert-action authoring for those roles — CVE-2026-76253 lets a schedule_search-only user run arbitrary SPL with system-level privilege and read every credential in the credential store, which is a materially larger blast radius than the role's intended scope.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Lateral Movement TA0008
T1550.001Use Alternate Authentication Material: Application Access Token
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.