CVE-2026-76323 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Processing Language (SPL) safeguards for risky commands through the Job Details dashboard. The injected SPL could run using the permissions of an authenticated user who opens a crafted Job Details dashboard link. This could allow access to all relevant data and affect system integrity within those permissions. The vulnerability is possible because the Job Details dashboard does not correctly neutralize a caller-supplied search identifier before placing it into SPL searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The user who does not hold the "admin" or "power" Splunk roles should not be able to exploit the vulnerability at will. For more information see About jobs and job management (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/manage-jobs/about-jobs-and-job-management) in the Splunk documentation.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
A critical security flaw exists within Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, specifically affecting the Job Details dashboard functionality. This vulnerability allows users who lack elevated privileges such as admin or power roles to bypass Search Processing Language safeguards designed for risky commands. The core technical issue stems from an improper neutralization of caller-supplied search identifiers when they are integrated into SPL searches within the dashboard interface. By injecting maliciously crafted input, an attacker can manipulate how the system processes job details, effectively circumventing permission checks that should restrict access to sensitive data or dangerous operations for lower-privileged users.
The operational impact of this vulnerability is significant as it enables unauthorized data exfiltration and potential compromise of system integrity within the scope of the victim user's permissions. When an authenticated user opens a specially crafted Job Details dashboard link, the injected SPL executes with that user's access rights rather than being restricted by the intended security policies for non-administrative accounts. This means that even users who are not supposed to have broad data access or command execution capabilities can potentially view all relevant data associated with their role level and execute commands they should be prohibited from running. The attack vector relies heavily on social engineering, requiring the attacker to phish a target user into clicking the malicious link, which then triggers the exploitation of this input validation failure in the backend search processing logic.
From a classification perspective, this vulnerability aligns with CWE-79, known as Improper Neutralization of Input During Web Page Generation, commonly referred to as Cross-Site Scripting or injection flaws depending on context, though here it specifically relates to command injection within a specialized query language framework. It also maps to MITRE ATT&CK techniques involving Initial Access through phishing and subsequent Execution via injected commands that leverage existing user privileges. The failure lies in the application's inability to properly sanitize or validate the search identifier parameter before embedding it into the SPL context, allowing arbitrary code execution under the guise of legitimate dashboard operations.
Mitigation strategies primarily involve upgrading Splunk Enterprise to version 10.4.2 or later where this input validation issue has been addressed by the vendor. In environments where immediate patching is not feasible, administrators should implement strict network segmentation and access controls to limit exposure to internal dashboards that might be targeted. Additionally, user awareness training regarding phishing attempts can reduce the likelihood of successful exploitation since the attack requires a victim to actively open a crafted link. Monitoring for unusual SPL query patterns or unexpected job executions by low-privileged users may also help in detecting attempted exploits before significant damage occurs.