Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This could allow for unauthorized search execution. The vulnerability is possible because Splunk Web does not consistently escape caller-supplied values when it builds SPL for nearby-event searches, and embedded report access accepts those requests without the expected authorization check. For more information see Use time to find nearby events (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.2/specify-time-ranges/use-time-to-find-nearby-events) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T22:17:16.140Z",
  "pubdate": "2026-08-19T22:17:16.140Z",
  "executiveSummary": "An unauthenticated arbitrary Search Processing Language (SPL) injection vulnerability exists in Splunk Enterprise. The flaw affects versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability allows remote, unauthenticated attackers to execute unauthorized searches by injecting malicious SPL into requests designed to search for events near a selected event. The root cause stems from improper input sanitization and inadequate authorization checks within Splunk Web and embedded report access components. Successful exploitation enables unauthorized search execution, potentially exposing sensitive data and computational resources without requiring valid user authentication or privileges.",
  "technicalDetails": "The vulnerability resides within Splunk Web and its handling of search requests targeting nearby events. The root cause of the flaw is twofold: first, Splunk Web fails to consistently escape caller-supplied values when dynamically constructing Search Processing Language (SPL) queries for nearby-event searches; second, embedded report access mechanisms accept these improperly validated requests without enforcing the expected authorization checks. Affected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Exploitation requires no prior authentication or specialized privileges, allowing unauthenticated threat actors interacting with the web interface to submit crafted HTTP requests containing malicious payloads. The attack flow begins when an unauthenticated user sends a manipulated request designed to leverage the nearby-events functionality. Because input validation and escaping are absent, the injected SPL strings are concatenated directly into the resulting search query executed by the backend. Simultaneously, the embedded report access mechanism bypasses standard authorization validation, permitting the execution of the unauthorized query context. Consequently, the attacker can force the platform to process arbitrary search commands, retrieve restricted operational data, or drain processing capacity. Post-exploitation impact is characterized by unauthorized data access, potential information disclosure of sensitive logs, and denial of service through heavy query execution."
}