CVE-2026-76341

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user with the "power" role can store malicious Search Processing Language (SPL) within a Table Editor dataset and share it. When a user with the "admin" role opens this dataset in the Table Editor, the SPL is executed with the admin user's permissions. This can lead to the exposure of sensitive data and the modification of limited data on the search head. The issue occurs because the Table Editor fails to apply SPL safeguards for risky commands during the preparation of the dataset initial data. Exploitation requires the attacker to phish the admin user into initiating a request via their browser.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.