What’s Vulnerable › Vulnerabilities
CVE-2026-76270: Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-07 · updated 2026-10-14
- Weakness: CWE-89
Description
In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer (REST) API, including private SPL2 module definitions belonging to other users. The vulnerability is possible because Splunk Enterprise and Splunk Cloud Platform do not parameterize user-supplied values before using them in database queries for SPL2 module filtering. For more information see Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) and Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) in the Splunk documentation. Splunk Enterprise versions 10.2.x, 10.0.x, and 9.4.x are not affected.
Affected products
- Splunk Enterprise: from 10.4.0 before 10.4.3 — fixed in 10.4.3
How to fix
Upgrade to a fixed version: Splunk Enterprise 10.4.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-76270 or the next vulnerability affects your stack