CVE-2026-76329: SPL Injection through Monitoring Console Dashboard Inputs in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could expose data available to that user or modify lookup data. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations running Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, or 9.4.14 are exposed if a user with the admin Splunk role can be induced to open a crafted Monitoring Console link. The attacker does not need to authenticate, but exploitation is not possible at will.
What must an attacker do to exploit it?
The attacker must craft a Monitoring Console link and successfully trick an admin-role user into opening it. Exploitation requires user interaction and relies on phishing or a similar social-engineering technique.
What can injected SPL do?
The attacker-controlled SPL runs with the permissions of the user who opens the link. It could expose data that user can access or modify lookup data.
How can this be remediated?
Update Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later, as applicable to the deployed release line.