Splunk Enterprise up to 10.0.9/10.2.6/10.4.2 Splunk App for Splunk O11y Cloud injection

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Splunk Enterprise up to 10.0.9/10.2.6/10.4.2. This impacts an unknown function of the component Splunk App for Splunk O11y Cloud. This manipulation causes injection. This vulnerability is handled as CVE-2026-76267. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Splunk Enterprise up to 10.0.9/10.2.6/10.4.2. Affected by this vulnerability is an unknown functionality of the component Splunk App for Splunk O11y Cloud. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect integrity. The summary by CVE is:

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log. Splunk Enterprise versions 9.4.x are not affected.

It is possible to read the advisory at advisory.splunk.com. This vulnerability is known as CVE-2026-76267 since 08/19/2026. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

Upgrading to version 10.0.10, 10.2.7 or 10.4.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Enterprise

Version

• 10.0.0
• 10.0.1
• 10.0.2
• 10.0.3
• 10.0.4
• 10.0.5
• 10.0.6
• 10.0.7
• 10.0.8
• 10.0.9
• 10.2.0
• 10.2.1
• 10.2.2
• 10.2.3
• 10.2.4
• 10.2.5
• 10.2.6
• 10.4.0
• 10.4.1
• 10.4.2

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion