CVE-2026-76309 - Vulnerability Details

- Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inject Structured Query Language (SQL) through the Representational State Transfer (REST) API, causing Splunk Enterprise to evaluate attacker-controlled text as part of a database query. The SQL injection is possible because the REST API incorporates user-supplied filter values into database queries without proper neutralization.

Published: 2026-08-19

Score: 4.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A low‑privileged user who is not an admin or power role can inject Structured Query Language commands into Splunk Enterprise by sending crafted data to the REST API, causing the system to execute attacker‑controlled text as part of a database query. This flaw is a classic input validation weakness and is classified as CWE-89.

Affected Systems

Splunk Enterprise versions earlier than 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate severity. EPSS is not available, suggesting limited evidence of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal or external API access with non‑privileged credentials, which could allow an attacker to read or alter sensitive data stored in Splunk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Splunk

Splunk Enterprise

affected

Version	Status	Constraints
`10.4`	affected	< 10.4.2
`10.2`	affected	< 10.2.6
`10.0`	affected	< 10.0.9
`9.4`	affected	< 9.4.14

Configuration 1 [-]

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*

No data.

Vendor Product Confidence Versions

Splunk

Splunk Enterprise

100%

Version	Status	Scheme	Platform
`[10.4,10.4.2)`	affected	semver	—
`[10.2,10.2.6)`	affected	semver	—
`[10.0,10.0.9)`	affected	semver	—
`[9.4,9.4.14)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Solution

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.

OpenCVE Recommended Actions

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later, as required by the vendor.
Limit REST API usage by restricting low‑privileged accounts from accessing endpoints that accept filter values; verify that only admin or power roles can use these APIs.
Apply network segmentation and firewall rules to restrict external access to the Splunk REST API, and monitor logs for anomalous query activity.

Generated by OpenCVE AI on August 20, 2026 at 10:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00216.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://advisory.splunk.com/advisories/SVD-2026-0801

History

Wed, 26 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 21 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Splunk splunk
CPEs		cpe:2.3:a:splunk:splunk:::::enterprise:::*
Vendors & Products		Splunk splunk

Wed, 19 Aug 2026 23:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Splunk Splunk splunk Enterprise
Vendors & Products		Splunk Splunk splunk Enterprise

Wed, 19 Aug 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description		In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inject Structured Query Language (SQL) through the Representational State Transfer (REST) API, causing Splunk Enterprise to evaluate attacker-controlled text as part of a database query. The SQL injection is possible because the REST API incorporates user-supplied filter values into database queries without proper neutralization.
Title		Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise
Weaknesses		CWE-89
References		https://advisory.splunk.com/advisories/SVD-2026-0801
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`

Subscriptions

Splunk Splunk Splunk Enterprise

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2026-08-19T21:34:20.209Z

Updated: 2026-08-26T15:23:04.652Z

Reserved: 2026-08-19T12:02:03.624Z

Link: CVE-2026-76309

Vulnrichment

Updated: 2026-08-26T14:49:16.683Z

NVD

Status : Analyzed

Published: 2026-08-19T22:17:14.580

Modified: 2026-08-26T16:16:39.120

Link: CVE-2026-76309

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-20T11:00:04Z

Weaknesses

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object