Description

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language (SPL) commands through the Data Model Editor using the permissions of the affected user. The commands could access all relevant data available to the affected user and affect system integrity. The vulnerability is possible because Splunk Web does not apply SPL safeguards for risky commands when the Data Model Editor runs the base search for auto-extracted fields. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who does not hold the "admin" or "power" Splunk roles should not be able to exploit the vulnerability at will. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-19T22:17:13.407Z",
  "pubdate": "2026-08-19T22:17:13.407Z",
  "executiveSummary": "An arbitrary Search Processing Language (SPL) command execution vulnerability exists in Splunk Enterprise. The flaw allows a low-privileged user, lacking 'admin' or 'power' roles, to manipulate another user into executing arbitrary SPL commands through the Data Model Editor, leveraging the victim's higher privileges.\nThe impact includes unauthorized access to all relevant data available to the affected user and potential compromise of system integrity. The vulnerability affects Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13.\nExploitation requires the attacker to successfully execute a phishing campaign against the affected user to trick them into initiating a malicious request within their browser. The unprivileged attacker cannot exploit the vulnerability autonomously at will without this user interaction.",
  "technicalDetails": "The vulnerability resides within the Data Model Editor component of Splunk Web. The root cause is the failure of Splunk Web to correctly apply SPL safeguards for risky commands when the Data Model Editor executes the base search for auto-extracted fields.\nAttack flow and exploitation method: An attacker who does not hold the 'admin' or 'power' Splunk roles constructs a malicious request targeting the Data Model Editor. Because low-privileged users cannot execute risky SPL commands directly due to platform security boundaries, the attacker relies on a cross-site context or induced browser request. The attacker phishes an affected user—typically an administrator or power user—tricking them into clicking a link or loading a crafted page that initiates the request within the victim's active browser session.\nWhen the victim's browser processes the request, the Data Model Editor executes the base search for auto-extracted fields. Due to the lack of proper validation and omission of SPL safeguards for risky commands in this specific context, the arbitrary SPL payload embedded in the request is processed using the authentication context and permissions of the affected user.\nAuthentication and privilege requirements: The underlying attacker lacks 'admin' or 'power' roles and cannot trigger the vulnerability directly. However, the attack successfully executes under the high-privilege context of the victimized user.\nPost-exploitation impact: The arbitrary SPL commands executed via this vector can access sensitive data streams available to the affected user and alter system integrity depending on the scope of the injected commands and the victim's privileges."
}