CVE-2026-76309

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A low-privileged user without admin or power roles can perform a SQL injection via the REST API. This occurs because the API fails to properly neutralize user-supplied filter values before incorporating them into database queries, allowing attacker-controlled text to be evaluated as part of the query.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.