Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language (SPL) searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. The vulnerability is possible when the Event Type Builder accepts cross-site request input and retains SPL-affecting values while building sample event searches. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Automatically find and build event types (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/9.0/event-types/automatically-find-and-build-event-types) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-19T22:17:16.007Z",
  "pubdate": "2026-08-19T22:17:16.007Z",
  "executiveSummary": "A cross-site request forgery (CSRF) vulnerability exists in Splunk Enterprise within the Event Type Builder component. The flaw allows an unauthenticated external attacker to induce an authenticated Splunk user into inadvertently executing arbitrary Search Processing Language (SPL) queries via malicious browser interactions, such as phishing. Successful exploitation enables unauthorized query execution within the security context of the victim, potentially leading to the exposure of sensitive operational data and stored credentials accessible to the authenticated user. The vulnerability stems from improper handling of cross-site request input and the retention of SPL-affecting values during the sample event search generation process. While the attack requires user interaction via phishing, it bypasses authentication boundaries by leveraging the victim's active session. Affected product versions include Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Organizations utilizing vulnerable versions face risks of data exfiltration and credential exposure through manipulated knowledge object operations.",
  "technicalDetails": "The vulnerability resides in the Event Type Builder component of Splunk Enterprise, specifically in how the application processes cross-site request input when automatically finding and building event types. The root cause is characterized by insufficient input validation and improper state retention, where the application accepts unverified input and preserves SPL-affecting values during the construction of sample event searches.\nThe attack flow requires an unauthenticated attacker to construct a malicious crafted request and deliver it to an authenticated victim via phishing vectors, tricking the victim's browser into initiating the request against the targeted Splunk Enterprise instance. Because the request relies on the victim's active session, the browser automatically includes necessary session cookies and authentication tokens. The vulnerable Event Type Builder processes the cross-site parameters and retains the injected SPL-affecting values.\nConsequently, the authenticated victim unintentionally executes arbitrary Search Processing Language (SPL) searches on behalf of the unauthenticated attacker. The payload behavior dictates the execution of arbitrary queries designed to query logs, indices, or configuration data. The post-exploitation impact includes the exposure of all relevant data accessible to the victim's permission level, as well as potential access to stored credentials associated with knowledge objects.\nThe affected components are present in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The attack vector is network-exposed via HTTP/HTTPS, requiring an external unauthenticated attacker to leverage social engineering (phishing) against an authenticated user session to trigger the flaw."
}