CVE-2026-76310 CVE-2026-76311 CVE-2026-76312 - Embedded Reports vulnerability

Applicability

Description

Splunk Security Advisory SVD-2026-0801 describes three vulnerabilities in the Embedded Reports feature of Splunk Enterprise: CVE-2026-76310, CVE-2026-76311, and CVE-2026-76312.

This article explains whether these vulnerabilities apply only when Embedded Reports is in use, and how to check whether Embedded Reports is turned on or in use.

Attackers can exploit all three vulnerabilities only through the Embedded Reports feature.

CVE-2026-76310 and CVE-2026-76311

An unauthenticated user with an embedded report token can download the dispatch archive of the report's search job and recover session material from it. When report embedding is turned off globally (allowEmbedTokenAuth = false), embedded report tokens can't be used, and these vulnerabilities can't be exploited.

CVE-2026-76312

The attacker must be able to read the HTML source of a web page that embeds a Splunk report. This condition can't be met when no reports are embedded. However, the official workaround in the advisory for this CVE is to turn off Splunk Web, not the allowEmbedTokenAuth setting. For the affected version range of CVE-2026-76312, see SVD-2026-0801.

Important notes

1. Embedding is allowed by default. The default value of allowEmbedTokenAuth is true. Even when no reports are currently embedded, users with the embed_report capability (by default, the power and admin roles) can embed a report at any time.

2. Being flagged by a scanner is not the same as being exploitable. Vulnerability scanners detect affected versions from the version string. The workaround blocks the attack path but does not remove the vulnerable code, so scanners continue to flag the instance until it is upgraded.

Investigation

Run the following checks on every search head. In a Search Head Cluster (SHC), check every cluster member and the deployer configuration.

Step 1. Check the global setting allowEmbedTokenAuth in server.conf

$SPLUNK_HOME/bin/splunk btool server list --debug | grep -i allowEmbedTokenAuth

A value of false means report embedding is turned off globally. No output, or a value of true, means the default applies and embedding is allowed.

Step 2. Check for reports that are currently embedded

When a report is embedded, Splunk adds embed.enabled = 1 to the report's stanza in savedsearches.conf.

$SPLUNK_HOME/bin/splunk btool savedsearches list --debug | grep -E "^\S+\s+\[|embed\.enabled"

Alternatively, run the following search in Splunk Web:

| rest /servicesNS/-/-/saved/searches splunk_server=local
| search embed.enabled=1
| table title eai:acl.app eai:acl.owner is_scheduled cron_schedule

If the search returns any reports, check each report's owner. Through CVE-2026-76310, an attacker can gain the permissions of the report owner, so embedded reports owned by users with the admin role are the highest risk.

Step 3. Check which roles have the embed_report capability

| rest /services/authorization/roles splunk_server=local
| search capabilities=embed_report OR imported_capabilities=embed_report
| table title capabilities imported_capabilities

Step 4. Check other settings related to embedding

The following settings are empty by default. If either one has a value, embedding was set up on purpose.

embedSecret in server.conf: shares embed links across search heads in a cluster.
embed_uri in web.conf: routes embedded reports around Single Sign-On (SSO).

$SPLUNK_HOME/bin/splunk btool server list --debug | grep -i embedSecret
$SPLUNK_HOME/bin/splunk btool web list --debug | grep -i embed_uri

Step 5. Interpret the results

Resolution

Workaround

1. If embedded reports are not used, turn off report embedding globally on every search head. Add the following setting and restart Splunk:

$SPLUNK_HOME/etc/system/local/server.conf[httpServer]
allowEmbedTokenAuth = false

$SPLUNK_HOME/bin/splunk restart

2. For each embedded report that is no longer needed, turn off embedding from Reports > Edit > Embed. This removes access to the report from external sites.

3. For CVE-2026-76312, the workaround in the advisory is to turn off Splunk Web. This makes the Splunk Web user interface unavailable on the instance, so apply it only where Splunk Web is not needed:

$SPLUNK_HOME/etc/system/local/web.conf[settings]
startwebserver = 0

Verification

After the restart, confirm that the setting is in effect:

$SPLUNK_HOME/bin/splunk btool server list --debug | grep -i allowEmbedTokenAuth

The expected output shows allowEmbedTokenAuth = false.

Fix

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later. Only the upgrade removes the vulnerable code. The workaround blocks the attack path, but vulnerability scanners continue to flag affected versions.

Related Links

Splunk Security Advisory SVD-2026-0801

Additional configuration for embedded reports

Embed scheduled reports