Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inject Structured Query Language (SQL) through the Representational State Transfer (REST) API, causing Splunk Enterprise to evaluate attacker-controlled text as part of a database query. The SQL injection is possible because the REST API incorporates user-supplied filter values into database queries without proper neutralization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:14.580Z",
  "pubdate": "2026-08-19T22:17:14.580Z",
  "executiveSummary": "A SQL injection vulnerability exists in Splunk Enterprise within the Representational State Transfer (REST) API component. The vulnerability allows a low-privileged user lacking \"admin\" or \"power\" Splunk roles to inject Structured Query Language (SQL) statements through the REST API, resulting in the evaluation of attacker-controlled text as part of database queries.\nThe primary impact of this flaw involves unauthorized database query execution driven by improper neutralization of user-supplied filter values. Affected systems include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nRisk implications center on potential data compromise, unauthorized database manipulation, and exposure of backend database structures. Attackers require low-privileged user access to the Splunk Enterprise REST API to successfully exploit this vulnerability.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper neutralization of user-supplied filter values within the Representational State Transfer (REST) API of Splunk Enterprise. Specifically, the vulnerable component incorporates input provided by API callers directly into database queries without sufficient parameterization or sanitization.\nAuthentication and privilege requirements dictate that an actor must possess low-privileged user credentials. However, the attacker must not hold the \"admin\" or \"power\" Splunk roles, indicating that standard or restricted user accounts are sufficient to initiate the attack flow.\nNetwork exposure involves the Splunk Enterprise REST API, which processes incoming Hypertext Transfer Protocol (HTTP) requests containing the malicious input payload.\nThe step-by-step attack flow proceeds as follows: First, an authenticated, low-privileged user crafts a malicious HTTP request destined for the Representational State Transfer (REST) API. Second, the request incorporates specially crafted input within user-supplied filter values designed to break out of the intended query context and introduce arbitrary SQL syntax. Third, the Splunk Enterprise backend receives the request and dynamically constructs a database query by concatenating the unneutralized filter values. Fourth, the underlying database engine evaluates the attacker-controlled text as executable SQL statements.\nPayload behavior involves the execution of injected SQL commands within the database context tied to the application. Post-exploitation impact encompasses unauthorized data access, potential data exfiltration, and manipulation of database contents depending on the privileges assigned to the database user execution context and the nature of the injected SQL statements.\nAffected versions comprise Splunk Enterprise instances below 10.4.2, 10.2.6, 10.0.9, and 9.4.14."
}