Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-76309

Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisco

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inject Structured Query Language (SQL) through the Representational State Transfer (REST) API, causing Splunk Enterprise to evaluate attacker-controlled text as part of a database query. The SQL injection is possible because the REST API incorporates user-supplied filter values into database queries without proper neutralization.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Splunk Splunk Enterprise

  • 10.4 to < 10.4.2affected
  • 10.2 to < 10.2.6affected
  • 10.0 to < 10.0.9affected
  • 9.4 to < 9.4.14affected

References