CVE-2026-76316
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language (SPL) pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all relevant data, affect system integrity, and affect availability of the Splunk platform instance. The SPL injection is possible because Deployment Server client identifiers are placed into dispatched searches without neutralizing special characters. Successful exploitation requires an administrator to open the affected Add Data forwarder workflow after the unauthenticated user registers a crafted Deployment Server client identity. For more information see Forward data (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.2/how-to-get-data-into-your-splunk-deployment/forward-data) and About agent management (https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/10.4/agent-management/about-agent-management) in the Splunk documentation.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS probability
- 0.30%
- CWE
- CWE-943
- Published
- 2026-08-19
- Last modified
- 2026-08-27
Affected products
- Splunk Splunk Enterprise
- Splunk Splunk Enterprise
- Splunk Splunk Enterprise
- Splunk Splunk Enterprise
Weakness type
Related vulnerabilities
- CVE-2026-82060 — Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups
- CVE-2026-62906 — Microsoft Discovery Studio Information Disclosure Vulnerability
- CVE-2026-85167 — n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
- CVE-2026-63138 — Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure
- CVE-2026-78691 — Unescaped backslash allows LIKE wildcard injection in AshSql string search
- CVE-2026-77846 — JSON path injection via unescaped get_path segments in AshSqlite
- CVE-2026-81528 — NoSQL injection via array replacement bypassing update shape validation in driver write path
- CVE-2026-81527 — NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation