In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory. This can cause distinct native Splunk usernames to share per-user configuration data, and user-management operations can affect the wrong account or fail. For more information see Set up native Splunk authentication (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-the-native-splunk-platform-authentication-scheme/set-up-native-splunk-authentication) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Splunk |
|
Configuration 1 [-]
|
No data.
References
| Link | Providers |
|---|---|
| https://advisory.splunk.com/advisories/SVD-2026-1001 |
|
History
Wed, 14 Oct 2026 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Splunk splunk
|
|
| CPEs | cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* | |
| Vendors & Products |
Splunk splunk
|
Thu, 08 Oct 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 07 Oct 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Splunk
Splunk splunk Enterprise |
|
| Vendors & Products |
Splunk
Splunk splunk Enterprise |
Wed, 07 Oct 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory. This can cause distinct native Splunk usernames to share per-user configuration data, and user-management operations can affect the wrong account or fail. For more information see Set up native Splunk authentication (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-the-native-splunk-platform-authentication-scheme/set-up-native-splunk-authentication) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation. | |
| Title | Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise | |
| Weaknesses | CWE-20 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: cisco
Published: 2026-10-07T20:46:35.907Z
Updated: 2026-10-08T15:06:09.743Z
Reserved: 2026-08-19T12:02:03.621Z
Link: CVE-2026-76277
Vulnrichment
Updated: 2026-10-08T15:04:51.987Z
NVD
Status : Analyzed
Published: 2026-10-07T21:17:18.900
Modified: 2026-10-14T12:03:45.950
Link: CVE-2026-76277
Redhat
No data.