CVE-2026-76353

CVE-2026-76353 is an arbitrary file deletion vulnerability in Splunk Enterprise's knowledge bundle delta processing endpoint, accessible through the cluster manager. The vulnerability sits at a distributed system seam that most threat models miss: the delta endpoint was designed as a configuration transport mechanism, but it also accepts deletion operations on arbitrary paths. The fix adds path validation where none existed — this was not a bypass of existing checks, but validation that was never written in the first place. The root cause is an 'administrative surface' assumption. When an endpoint is labeled cluster management, code review treats it as a single trust boundary rather than a composition of smaller authorization decisions. The delta endpoint performs three distinct operations — config transport, file system mutation, and cluster control — but the code treated 'admin role equals full access' as a single assertion. This is the same authorization-gap pattern seen in ZooKeeper ACL bypasses, etcd unauthorized deletes, and Elasticsearch transport layer escapes: trust accumulates at the coordinator node, authorization is delegated entirely to role assignment, and file operations are treated as safe because only administrators can trigger them. The CVSS 5.4 rating obscures the actual risk. Arbitrary file deletion on a cluster manager is a single injection point with propagation reach to every forwarder and search head in the deployment. You don't need to chain this with another vulnerability — a non-privileged user who can reach the delta endpoint can delete Splunk binaries or configuration state, blinding the security team to their own environment. The cluster manager is not just a coordination point; it's a propagation vector. Deployments have also changed around this code. The delta endpoint was likely written when Splunk clusters were smaller and user populations were closed groups of trusted administrators. As deployments scaled to hundreds of nodes with cross-site replication and expanded user populations, the original security assumptions rotted quietly. The code didn't change; the threat model around it did. This is the forgotten threat — code whose assumptions become invalid through benign neglect rather than through documented deprecation. What to check: Review whether your Splunk cluster manager is exposed to non-privileged users through forwarder channels or delegated access paths. Validate that the cluster manager's delta API endpoint is behind an authorization layer that enforces operation-level permissions, not just role membership. The patch adds explicit path validation — verify that your deployment has applied it, but recognize that the underlying assumption (role-level trust is sufficient) may still exist in other cluster management paths.

Reviewed through automated stages and approved by a human before publication.