Executive brief
Splunk Enterprise, a widely-used platform for searching, monitoring, and analyzing machine data and logs, contains a flaw in its geostats command that allows low-privileged users to inject malicious search commands. An attacker can trick an administrator or power user into executing a specially crafted search, which then runs with that user's elevated permissions. This could expose sensitive data like stored credentials or allow modification of data lookup files.
Technical details
The vulnerability is an SPL (Search Processing Language) injection flaw in the geostats command, classified as CWE-77. The root cause is insufficient input validation before the geostats command processes user-supplied arguments. A non-admin, non-power user can craft a malicious geostats search containing arbitrary SPL commands that execute with the permissions of any authenticated user who initiates the attacker-controlled search in Splunk Web. The attack requires social engineering (phishing) to trick a higher-privileged user into running the malicious search. Once executed, the injected SPL runs in the context of the targeted user, potentially exposing all data accessible to that user and modifying lookup files. Patches are available in Splunk Enterprise 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
Affected products
- Splunk Enterprise 10.4.0-10.4.1, 10.2.0-10.2.5, 10.0.0-10.0.8, 9.4.0-9.4.13
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Splunk Enterprise 10.4.2, 10.2.6, 10.0.9, and 9.4.14