CVE-2026-76331 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system integrity within Splunk Enterprise. The vulnerability is possible because Splunk Enterprise does not correctly validate caller-supplied time values before using them in saved-search dispatch. For more information see Search endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.2/search-endpoints/search-endpoint-descriptions) in the Splunk documentation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
A critical security vulnerability exists within Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, specifically affecting the handling of saved-search dispatch requests. This flaw allows users who lack elevated privileges such as admin or power roles to inject Search Processing Language commands into these requests. The root cause lies in insufficient validation of caller-supplied time values before they are processed by the system. When a user initiates a search through the REST API, particularly via endpoints related to saved searches, the application fails to properly sanitize input parameters that influence execution timing and context. This lack of rigorous input validation creates an avenue for attackers to manipulate how queries are executed, bypassing standard access controls designed to restrict data visibility based on role-based permissions.
The operational impact of this vulnerability is severe, as it effectively neutralizes the intended security boundaries within the Splunk environment. By injecting Search Processing Language commands, a low-privileged user can potentially execute arbitrary searches that access sensitive information they are not authorized to view. This leads to unauthorized data exfiltration and compromises the integrity of the system by allowing untrusted inputs to alter search behavior. The ability to manipulate saved-search dispatch mechanisms means that an attacker could craft payloads that exploit specific time-based logic or context switching within Splunk's indexing engine, leading to broader implications for confidentiality and potentially availability if malicious searches consume excessive resources.
From a classification perspective, this vulnerability aligns with CWE-79, which covers Cross-site Scripting involving improper neutralization of user input in web applications, although here it manifests as command injection via API parameters rather than direct script execution in a browser context. It also relates to CWE-20, Improper Input Validation, where the system fails to verify that inputs conform to expected formats or constraints before processing. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1505.003, Server Software Component: Stored Web Shell, if the injection leads to persistent backdoors, but more accurately maps to T1078, Valid Accounts, as it involves privilege escalation through misconfiguration or logic flaws rather than credential theft. The attack vector is typically remote and requires network access to the Splunk management interface, making it a significant risk for organizations with exposed administrative endpoints.
Mitigation strategies must prioritize immediate patching of all affected Splunk Enterprise instances to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 and later. Until patches are applied, administrators should enforce strict network segmentation to limit access to the Splunk management interface from untrusted networks. Implementing Web Application Firewalls with rules specifically designed to detect anomalous patterns in REST API payloads can provide an additional layer of defense by blocking requests containing suspicious Search Processing Language syntax or unexpected time parameter formats. Furthermore, organizations should review their role-based access control configurations to ensure that even if such a vulnerability is exploited, the blast radius is minimized through least-privilege principles and regular auditing of user permissions and search activity logs for anomalies indicative of injection attempts.