CVE-2026-76317 is a path traversal in Splunk's lookup configuration endpoint that allows low-privileged Splunk users to read arbitrary files accessible to the Splunk service account. The vulnerability stems from Splunk validating lookup paths against the staging directory before canonicalizing them — meaning symlinks, relative path components like '../../../', or other traversal techniques escape the intended sandbox. This is not an RBAC bypass; the attacker gains no admin or power privileges. Instead, they read files as whichever OS user runs the Splunk daemon.
The CVSS 8.8 score masks substantial deployment variance. In a well-hardened Splunk instance where the service account is intentionally limited to minimal filesystem access, the blast radius is contained. In typical production deployments where Splunk runs with broader access — especially domain-joined service accounts with cross-system trust relationships, or instances with access to TLS material, configuration vaults, or credential stores — this vulnerability provides a direct escalation path from a low-privilege Splunk user account to potentially sensitive credential material. Assess what your Splunk service account can reach: if it has access beyond Splunk's own configuration directories, treat this as higher priority than the CVSS implies.
The EPSS score of 0.0037 suggests low near-term exploitation probability, which is likely accurate for the near term given the requirement for an authenticated Splunk session and knowledge of the lookup interface. However, this is precisely the vulnerability class that appears in attacker toolkits once a working exploit surfaces. Prior variants in the same lookup subsystem (CVE-2023-40515, CVE-2022-43552) suggest the canonicalization bypass pattern will recur.
Before patching, audit your lookup configurations for any that rely on relative paths, symlinks, or non-canonical staging structures. The patch presumably adds realpath() or equivalent canonicalization, which may break legitimate configurations — test in staging first. If you have compliance-critical lookups that depend on traversal-prone patterns, you face a migration timeline: patch and validate, or accept elevated risk from an unpatched instance. Choose the former, but budget the testing cycle.