CVE-2026-76349
In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language (SPL) commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access all relevant data. The vulnerability does not affect Splunk Enterprise 10.4 versions and above. The vulnerability is possible because Splunk Web substitutes form token values supplied through the Uniform Resource Locator (URL) into SPL searches without neutralizing them. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Token reference (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/simple-xml-dashboards/10.2/simple-xml-reference/token-reference) in the Splunk documentation.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.4
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
- EPSS probability
- 0.21%
- CWE
- CWE-943
- Published
- 2026-08-19
- Last modified
- 2026-08-20
Affected products
- Splunk Splunk Enterprise
- Splunk Splunk Enterprise
- Splunk Splunk Enterprise
Weakness type
Related vulnerabilities
- CVE-2026-82060 — Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups
- CVE-2026-62906 — Microsoft Discovery Studio Information Disclosure Vulnerability
- CVE-2026-85167 — n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
- CVE-2026-63138 — Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure
- CVE-2026-78691 — Unescaped backslash allows LIKE wildcard injection in AshSql string search
- CVE-2026-77846 — JSON path injection via unescaped get_path segments in AshSqlite
- CVE-2026-81528 — NoSQL injection via array replacement bypassing update shape validation in driver write path
- CVE-2026-81527 — NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation