Description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language (SPL) pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all relevant data, affect system integrity, and affect availability of the Splunk platform instance. The SPL injection is possible because Deployment Server client identifiers are placed into dispatched searches without neutralizing special characters. Successful exploitation requires an administrator to open the affected Add Data forwarder workflow after the unauthenticated user registers a crafted Deployment Server client identity. For more information see Forward data (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.2/how-to-get-data-into-your-splunk-deployment/forward-data) and About agent management (https://help.splunk.com/en/splunk-enterprise/administer/update-your-deployment/10.4/agent-management/about-agent-management) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:15.500Z",
  "pubdate": "2026-08-19T22:17:15.500Z",
  "executiveSummary": "An unauthenticated SPL injection vulnerability exists in Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14.\nThe vulnerability allows an unauthenticated attacker who can reach the Splunk management port to store a malicious Search Processing Language pipeline.\nSuccessful exploitation requires user interaction, specifically an administrator opening the Add Data forwarder workflow after a crafted Deployment Server client identity is registered.\nThe impact includes unauthorized access to all relevant data, potential compromise of system integrity, and degradation or loss of platform availability.\nRisk implications are severe due to the potential exposure of sensitive organizational data and administrative escalation vectors triggered during standard management workflows.",
  "technicalDetails": "The root cause of the vulnerability is the improper neutralization of special characters when Deployment Server client identifiers are dynamically inserted into dispatched searches.\nNetwork exposure involves accessibility to the Splunk management port by unauthenticated users, requiring no prior authentication or administrative privileges to register the malicious payload.\nThe vulnerable component handles Deployment Server client identities and incorporates them directly into Search Processing Language pipelines without input sanitization or parameterization.\nThe attack flow begins when an unauthenticated attacker registers a crafted Deployment Server client identity containing malicious Search Processing Language syntax via the exposed management port.\nThe crafted pipeline is stored within the system as part of the client identifier registration process.\nSubterior exploitation occurs asynchronously when a high-privileged administrator navigates to and opens the Add Data forwarder workflow.\nUpon opening the workflow, the stored Search Processing Language pipeline executes within the administrative context.\nPayload execution allows unauthorized access to all relevant operational data accessible by the administrative user.\nFurthermore, the injected pipeline can affect system integrity and platform availability.\nAffected versions comprise Splunk Enterprise instances below 10.4.1, 10.2.5, 10.0.9, and 9.4.14."
}