CVE-2026-76320: SPL Injection through Cross-Site Request Forgery (CSRF) in the Event Type Builder in Splunk Web for Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language (SPL) searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. The vulnerability is possible when the Event Type Builder accepts cross-site request input and retains SPL-affecting values while building sample event searches. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Automatically find and build event types (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/9.0/event-types/automatically-find-and-build-event-types) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.4.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.2.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.4.14
Event History
Frequently Asked Questions
Who is exposed to this issue?
Splunk Enterprise deployments below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected when a user is authenticated to Splunk Web and uses a browser that can be induced to send a request to the Event Type Builder.
What does an attacker need to exploit it?
The attacker does not need to authenticate, but must successfully phish an authenticated user into initiating a request in their browser. Exploitation is not possible at will because it depends on that user interaction.
What could an attacker obtain through a successful attack?
The attacker can cause the authenticated user to run arbitrary SPL searches on their behalf. This may expose data available to that user, including relevant stored credentials.
How can I determine whether my deployment is affected?
Check the installed Splunk Enterprise version. Versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected.