CVE-2026-76343

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description Users without admin or power roles can execute arbitrary Structured Query Language (SQL) queries via the Data Orchestration jobs endpoint. This occurs because the system constructs database queries using user-controlled job filter values without employing parameterized queries, which are queries that use placeholders to prevent malicious input from being executed as code. This flaw allows unauthorized access to nearly all data managed by Data Orchestration, including connection credentials and jobs belonging to other users.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.