Red Hat Multicluster Engine hits 9.9 while Splunk leaks sessions to anyone with a browser

An unauthenticated attacker who can view the HTML source of a page embedding a Splunk report can grab exposed session material from the dispatch archive download path. That session material lets them access all the data the report can see and tamper with system integrity. No login required, just the ability to reach the page with the embedded report.

Affected estate

Splunk Enterprise operators running versions before 10.4.1, 10.2.6, 10.0.9, or 9.4.14 who use embedded reports

How to check

Run `splunk version` on your search heads. Check Settings > Embedded Reports to see if any reports are published as embedded.

Included because

unauthenticated; internet-facing if embedded reports are exposed; CVSS 9.4; session material leakage

Action

Upgrade to the fixed version for your release track. Review and disable any unnecessary embedded reports.

Why it matters

Unauthenticated access to session material means an attacker can read all data the embedded report's user context can reach, with no credentials needed.

Source

Splunk advisory

This is closely related to CVE-2026-76312 but with a slightly different attack path. An unauthenticated attacker who has an embedded report token can download the dispatch archive for that report's search job. The archive contains session material that lets the attacker access data and compromise system integrity. The auth flow fails to block the download request before the archive starts streaming.

Affected estate

Splunk Enterprise operators running versions before 10.4.2, 10.2.6, 10.0.9, or 9.4.14 who use embedded reports

How to check

Run `splunk version` on your search heads. Check for embedded report tokens in use via Settings > Embedded Reports.

Included because

unauthenticated; CVSS 9.4; session material leakage; same attack surface as CVE-2026-76312

Action

Upgrade to the fixed version. Rotate any embedded report tokens that may have been exposed. Review dispatch archive access logs for suspicious downloads.

Why it matters

An attacker with just an embed token can grab session material and escalate to full data access on the Splunk instance, no authentication needed.

Source

Splunk advisory

The cluster-proxy-addon in Multicluster Engine for Kubernetes has a path traversal bug in its user-facing route. An unauthenticated attacker can manipulate URL path segments to bypass all auth checks and proxy requests to arbitrary services on any managed cluster. That means they can reach internal services that should never be exposed, across every cluster you manage.

Affected estate

Anyone running Red Hat Multicluster Engine for Kubernetes with the cluster-proxy-addon exposed

How to check

Run `kubectl get pods -A | grep cluster-proxy` to confirm the addon is deployed. Check ingress or route objects for the proxy's external endpoint.

Included because

unauthenticated; internet-facing route; CVSS 9.3; bypasses auth and authz; cross-cluster impact

Action

Apply the patched version of the cluster-proxy-addon. Restrict the proxy route behind a firewall or network policy until patched. Audit logs for unusual proxy requests to internal services.

Why it matters

Unauthenticated access to internal services across all managed clusters is a direct path to full environment compromise.

Source

Red Hat advisory

A user with Custom Resource editor privileges on the search-v2-operator can inject arbitrary secrets, environment variables, or swap the container image for a malicious one by editing Search CR fields. Because the operator's ServiceAccount has broad impersonation permissions, this leads straight to full cluster compromise. This does require the attacker to already have CR editor access, so it's an insider or post-compromise escalation path.

Affected estate

Anyone running Red Hat Advanced Cluster Management or Multicluster Engine with the search-v2-operator deployed, especially where CR editor access is delegated broadly

How to check

Run `kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.name | contains("search"))'` to identify who can edit Search CRs. Check the Search CR spec for unexpected imageOverride, arguments, or env values.

Included because

CVSS 9.1; privilege escalation to cluster admin; requires CR editor access (reduces but doesn't eliminate risk); pairs with CVE-2026-70496

Action

Patch the search-v2-operator. Immediately review and tighten RBAC for Search CR editors. Check existing Search CRs for signs of tampering (unexpected images, mounted secrets, modified args).

Why it matters

A CR editor can mount cluster secrets or replace the operator's container image, then use the ServiceAccount's impersonation rights to take over the entire cluster.

Source

Red Hat advisory