Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system integrity within Splunk Enterprise. The vulnerability is possible because Splunk Enterprise does not correctly validate caller-supplied time values before using them in saved-search dispatch. For more information see Search endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.2/search-endpoints/search-endpoint-descriptions) in the Splunk documentation.
Published: 2026-08-19
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Splunk Enterprise versions below the specified patch levels allow a non‑admin or non‑power user to inject Search Processing Language (SPL) into saved‑search dispatch requests. This injection bypasses proper validation of caller‑supplied time values, permitting the attacker to execute arbitrary SPL and read or modify any data visible within the user’s scope. The vulnerability therefore undermines data confidentiality and system integrity in Splunk Enterprise.

Affected Systems

The affected product is Splunk Enterprise. Versions impacted include all releases earlier than 10.4.2, 10.2.6, 10.0.9, and 9.4.14. An individual with a role other than "admin" or "power" can exploit the flaw via the REST API.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity. EPSS is not available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in CISA KEV. The most likely attack vector is through the public REST API endpoint that accepts time parameters for saved‑search dispatches, and the weakness is classified as CWE‑943.

Generated by OpenCVE AI on August 20, 2026 at 09:52 UTC.

Remediation

Vendor Solution

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.

OpenCVE Recommended Actions

  • Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, 9.4.14, or newer.
  • Restrict the REST API dispatch endpoint to users with "admin" or "power" roles only.
  • Implement server‑side validation to ensure time values are properly checked before use in saved‑search requests.

Generated by OpenCVE AI on August 20, 2026 at 09:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Splunk splunk
CPEs cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
Vendors & Products Splunk splunk

Wed, 19 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Splunk
Splunk splunk Enterprise
Vendors & Products Splunk
Splunk splunk Enterprise

Wed, 19 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system integrity within Splunk Enterprise. The vulnerability is possible because Splunk Enterprise does not correctly validate caller-supplied time values before using them in saved-search dispatch. For more information see Search endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.2/search-endpoints/search-endpoint-descriptions) in the Splunk documentation.
Title SPL Injection through the REST API in Splunk Enterprise
Weaknesses CWE-943
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Splunk Splunk Splunk Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-08-27T16:24:58.088Z

Reserved: 2026-08-19T12:02:03.627Z

Link: CVE-2026-76331

cve-icon Vulnrichment

Updated: 2026-08-27T16:17:29.359Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-19T22:17:17.423

Modified: 2026-08-27T17:20:14.300

Link: CVE-2026-76331

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T10:00:07Z

Weaknesses
  • CWE-943

    Improper Neutralization of Special Elements in Data Query Logic