CVE-2026-76332: SPL Injection through Splunk Web in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could access data and perform actions available to that user. The vulnerability is possible because Analytics Workspace does not sufficiently validate data used to build searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Organizations running Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, or 9.4.14 are exposed when an authenticated user can be persuaded to open a crafted Analytics Workspace link. The impact is limited to the data and actions permitted to the targeted user's account.
What does an attacker need to exploit this issue?
The attacker does not need to authenticate, but must successfully phish an authenticated user into opening a crafted link to Analytics Workspace. Exploitation is not possible at will without that user interaction.
What can be done if patching is not immediately possible?
Reduce exposure by warning authenticated users not to open untrusted or unsolicited Analytics Workspace links. Since injected SPL runs with the victim's permissions, prioritize this guidance for users with access to sensitive data or capabilities to perform impactful actions.