CVE-2026-76309 PUBLISHED

Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

Assigner: cisco
Reserved: 19.08.2026 Published: 19.08.2026 Updated: 19.08.2026

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inject Structured Query Language (SQL) through the Representational State Transfer (REST) API, causing Splunk Enterprise to evaluate attacker-controlled text as part of a database query. The SQL injection is possible because the REST API incorporates user-supplied filter values into database queries without proper neutralization.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Splunk
Product	Splunk Enterprise
Versions	affected from 10.4 to 10.4.2 (excl.) affected from 10.2 to 10.2.6 (excl.) affected from 10.0 to 10.0.9 (excl.) affected from 9.4 to 9.4.14 (excl.)

Solutions

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.

Credits

Gabriel Nitu, Splunk reporter

References

https://advisory.splunk.com/advisories/SVD-2026-0801

Problem Types

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. cwe