CVE-2026-76313

This CVE exposes a trust boundary failure in Splunk's distributed search architecture: the REST endpoint for knowledge bundle upload lacks the edit_dist_peer capability check that other distributed search operations enforce. A low-privilege user can exploit this by uploading a malicious knowledge bundle that gets propagated to search peers, achieving RCE through architectural positioning rather than exploit chains. The attack surface is the implicit trust model between search heads and peers — communication is authenticated at the infrastructure level but capability enforcement is applied per-feature, not holistically. This isn't a new pattern for Splunk: CVE-2022-43571 and CVE-2023-46214 involved similar authorization gaps in distributed search contexts, suggesting institutional failure in auditing legacy endpoints as the capability model evolves. The forensic question — whether edit_dist_peer was never implemented on this endpoint or was removed during refactoring — matters for remediation design: the former indicates incomplete threat modeling at feature creation, the latter indicates static analysis opportunities for authorization pattern drift. Check your Splunk deployment for the edit_dist_peer capability on /servicesNS/{user}/{app}/storage/transforms/collections endpoints and any bundle-related REST handlers. If you're running affected versions (review Splunk advisory for exact versions), prioritize patching — but also audit other distributed search endpoints for consistent capability enforcement, as this pattern suggests systemic gaps beyond the single patched endpoint. The blast radius scales with search peer topology: deployments with more peers face proportionally larger exposure from a single successful exploit.

Reviewed through automated stages and approved by a human before publication.