Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could bypass Search Processing Language (SPL) safeguards for risky commands through the Job Details dashboard. The injected SPL could run using the permissions of an authenticated user who opens a crafted Job Details dashboard link. This could allow access to all relevant data and affect system integrity within those permissions. The vulnerability is possible because the Job Details dashboard does not correctly neutralize a caller-supplied search identifier before placing it into SPL searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The user who does not hold the "admin" or "power" Splunk roles should not be able to exploit the vulnerability at will. For more information see About jobs and job management (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/manage-jobs/about-jobs-and-job-management) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-19T22:17:16.393Z",
  "pubdate": "2026-08-19T22:17:16.393Z",
  "executiveSummary": "This vulnerability involves an improper neutralization of input within the Job Details dashboard of Splunk Enterprise, leading to Search Processing Language (SPL) injection and safeguard bypass. The flaw enables low-privileged authenticated users who lack 'admin' or 'power' roles to bypass restrictions governing risky commands. The impact includes unauthorized access to sensitive data and potential compromise of system integrity, constrained by the privileges of the victim who opens a malicious link. Exploitation requires a phishing vector where an attacker must trick an authenticated user into clicking a specially crafted URL containing the injected search identifier. The affected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.",
  "technicalDetails": "The vulnerability stems from the Job Details dashboard failing to correctly sanitize and neutralize caller-supplied search identifiers prior to incorporating them into Search Processing Language (SPL) execution strings. This programmatic oversight permits the injection of arbitrary SPL syntax, effectively bypassing built-in security safeguards designed to restrict risky commands for users lacking administrative or power privileges. The vulnerable component is the Job Details dashboard processing routine within Splunk Enterprise. Affected software versions comprise Splunk Enterprise instances below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Although the unprivileged attacker cannot execute the attack autonomously at will due to access control limitations, the attack vector relies on social engineering. The attacker crafts a malicious link targeting the Job Details dashboard containing an injected SPL payload and distributes this link to a victim via phishing. When an authenticated user opens the crafted URL, the malicious SPL executes within the context of that user's session. Consequently, the injected commands inherit the permissions of the victimized user, potentially granting unauthorized access to all relevant data repositories and impacting system integrity within the scope of those permissions."
}