Skip to content
Heist/ feed
High

Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise

Type: advisorySource: Official CVE List1 source record

In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app. The requests could cause the Splunk daemon to consume excessive system resources and potentially stop responding. The vulnerability is possible because the endpoint accepts package download requests without authentication and reads and base64-encodes the complete package in memory for each request. After upgrading, prepare all existing Edge Processor instances, turn on authentication for Edge Processor package downloads, and restart Splunk Enterprise. For more information, see Enable authentication for Edge Processor package downloads (https://help.splunk.com/en/data-management/process-data-at-the-edge/use-edge-processors-for-splunk-enterprise/10.4/administer-edge-processors/enable-authentication-for-edge-processor-package-downloads).

Announced Source revision 1
Original source ↗

CVE-2026-76290

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-76290

Splunk Enterprise

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Splunk",
    "modules": [
      "REST API"
    ],
    "product": "Splunk Enterprise",
    "versions": [
      {
        "status": "affected",
        "version": "10.4",
        "lessThan": "10.4.4",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.2",
        "lessThan": "10.2.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.0",
        "lessThan": "10.0.11",
        "versionType": "custom"
      }
    ]
  }
]
Related CVEs
CVE-2026-76290

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#50250 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement