CVE-2026-76342

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user with the "power" role can store risky Search Processing Language (SPL) commands within a Table Editor dataset and share it. When a user with the "admin" role opens this dataset in the Table Editor, the commands are triggered and executed with the admin user's permissions. This can lead to the exposure of sensitive data and the modification of lookup files. The issue occurs because the Table Editor fails to apply SPL safeguards for risky commands during the field-summary search performed for the Initial Data step. Exploitation requires the attacker to phish the admin user into initiating a request within their browser.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.