CVE-2026-76309: Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inject Structured Query Language (SQL) through the Representational State Transfer (REST) API, causing Splunk Enterprise to evaluate attacker-controlled text as part of a database query. The SQL injection is possible because the REST API incorporates user-supplied filter values into database queries without proper neutralization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged Splunk Enterprise user can exploit it through the REST API. The affected user does not need the "admin" or "power" Splunk roles.
Which deployments are affected?
Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected. The issue is exposed where a low-privileged user can access the REST API and supply filter values.
What does an attacker need to do to exploit it?
The attacker needs valid low-privileged access and the ability to send REST API requests containing crafted filter values. No user interaction is required, and the attack can be performed over the network.