CVE-2026-76354 is a path injection vulnerability in Splunk Search Head Clustering bundle replication that allows a low-privilege user to delete or temporarily overwrite files on cluster members by injecting a crafted filename through the REST API. The vulnerability lives in the receiving-side processing of bundle sync requests — specifically, when a non-captain member accepts replication data, the code constructs filesystem paths from user-supplied input without sanitizing NUL bytes or validating path components. This enables the attacker to escape the intended bundle directory and manipulate arbitrary files that the Splunk service account can write.
The constraint requiring a non-captain member target is the key architectural detail. Splunk's clustering model treats the captain as authoritative and members as passive recipients, meaning validation was expected to happen at the source (the captain) rather than the destination (each member). This vulnerability is a failure to implement that source-side validation — the attack surface is every cluster member (N-1 in an N-node cluster), not a single point.
The NUL byte omission is the specific technical flaw. Path construction in Splunk's replication pipeline didn't account for C-style string termination when bridging to filesystem operations, allowing an attacker to truncate the path and escape directory constraints. This pattern — NUL byte injection in path construction over a trusted internal channel — has been documented across multiple vendors and decades of CVEs. The fact that Splunk previously addressed this exact pattern class in a 2019 CVE but failed to audit their cluster replication pipeline demonstrates organizational amnesia: the lesson learned didn't propagate across architectural boundaries within the same product.
The CVSS 8.1 score underweights the supply-chain dimension. The vulnerability allows overwriting bundle configuration files that replicate to all cluster members and execute on the next operational cycle — this isn't just local file access, it's a mechanism to inject malicious configuration across a distributed system with a single low-privilege API call.
Check your Splunk version: 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain the fix. Prioritize upgrading search head cluster members. Beyond patching, verify that your Splunk service account has minimal filesystem permissions — the vulnerability's impact scales directly with what that account can write. Monitor for unexpected bundle sync operations from non-captain members and audit REST API access logs for anomalous filename patterns in bundle replication requests. The clustering architecture means a 10-node cluster has 9 vulnerable endpoints; treat each member's replication intake as an attack surface, not just the captain.