Executive brief
Splunk Enterprise, a widely-used data analytics and security monitoring platform, contains a vulnerability that allows attackers to inject malicious Search Processing Language (SPL) commands through specially crafted web links. An unauthenticated attacker must trick an authenticated user into clicking the malicious link, after which arbitrary SPL commands can execute with the victim's permissions, potentially exposing sensitive data. The attack requires social engineering via phishing, making it depend on user interaction rather than direct exploitation.
Technical details
This is an SPL injection vulnerability in Splunk Web's form token substitution logic (CWE-943). The root cause is improper input neutralization: Splunk Web substitutes form token values supplied via URL parameters directly into SPL searches without sanitization or escaping. An unauthenticated attacker crafts a URL containing malicious SPL syntax embedded in token parameters, then phishes an authenticated user to click the link. When the victim opens the link in an authenticated session, the injected SPL commands execute with the victim's permissions, allowing access to arbitrary data. The vulnerability affects Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, but does not affect 10.4 and later. Patches are available in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
Affected products
- Splunk Enterprise below 10.2.6, 10.0.9, and 9.4.14 (10.4 and above unaffected)
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Patches released in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14