Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant data and system integrity available to that user and affect system availability. The vulnerability is possible because Dataset Explorer does not validate or escape dataset names before building SPL searches and does not apply SPL safeguards for risky commands to those searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Explore a dataset (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.4/manage-and-explore-datasets/explore-a-dataset) and SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T22:17:13.270Z",
  "pubdate": "2026-08-19T22:17:13.270Z",
  "executiveSummary": "A vulnerability exists in Splunk Enterprise that allows an unauthenticated attacker to induce another user into dispatching arbitrary Search Processing Language (SPL) pipelines through the Dataset Explorer. This security flaw stems from insufficient input validation and sanitization regarding dataset names, combined with the absence of SPL safeguard enforcement for risky commands within the affected component.\nThe primary impact of this vulnerability includes unauthorized access to all relevant data accessible by the victim user, potential compromise of system integrity, and degradation of system availability. Successful exploitation requires user interaction, specifically via a phishing vector where an attacker tricks a legitimate user into opening a maliciously crafted hyperlink. Consequently, unauthenticated attackers cannot exploit this vulnerability autonomously or at will without this victim interaction.\nAffected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14. The risk implications are severe due to the potential execution of arbitrary search logic under the security context and privilege level of the targeted victim user.",
  "technicalDetails": "The vulnerability resides within the Dataset Explorer component of Splunk Enterprise, specifically affecting versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14. The root cause of the issue is twofold: the Dataset Explorer fails to properly validate or escape dataset names prior to constructing SPL search queries, and it does not apply standard SPL safeguards designed to restrict risky commands within those dynamically built searches.\nFrom an authentication and network perspective, the vulnerability involves an unauthenticated attacker interacting with Splunk Enterprise over the network. However, direct exploitation by the unauthenticated entity is restricted because the attack flow mandates intermediary user interaction. The attacker must execute a phishing campaign or social engineering attack, enticing a authenticated user with elevated privileges to click on a specifically crafted URL containing malicious input parameters.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a malicious link targeting the Dataset Explorer interface, injecting arbitrary SPL commands or sequences into the dataset name parameter without proper sanitization. Second, the attacker delivers this crafted link to a victim user via phishing techniques. Third, when the victim user clicks the link and opens it within their authenticated session, the Dataset Explorer processes the unsanitized input without applying SPL safeguards for risky commands. Fourth, the application dynamically builds and dispatches the resulting arbitrary SPL pipeline. Finally, the search executes utilizing the exact privileges of the victim user.\nThe post-exploitation impact allows the execution of arbitrary SPL commands with the privilege set of the targeted user. This can lead to unauthorized data access across all data sources available to that user, potential manipulation or extraction of sensitive knowledge objects, and adverse effects on system availability due to resource-intensive query execution."
}