CVE-2026-76267

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10

Description A user with the read o11y content capability can inject forged entries into the app log via the REST API. This occurs because the Splunk App for Splunk O11y Cloud fails to neutralize user-supplied SignalFlow content before it is written to the log.

Recommendations Update Splunk Enterprise to version 10.4.3 or later. Update Splunk Enterprise to version 10.2.7 or later. Update Splunk Enterprise to version 10.0.10 or later.