Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick a user who holds the "admin" Splunk role into opening a crafted link to Monitoring Console. When that user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could expose data available to that user or modify lookup data. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-19T22:17:17.180Z",
  "pubdate": "2026-08-19T22:17:17.180Z",
  "executiveSummary": "Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain an input validation vulnerability within the Monitoring Console component.\nThe vulnerability allows an unauthenticated remote attacker to construct a crafted link designed to execute arbitrary Search Processing Language (SPL) queries under the execution context and security privileges of a targeted user holding the administrative Splunk role.\nSuccessful exploitation requires social engineering or a phishing vector to deceive an administrative user into interacting with the malicious link, as unauthenticated attackers cannot exploit the flaw autonomously at will.\nThe resulting impact includes unauthorized data exposure accessible to the administrative user context, as well as the potential modification of system lookup data.\nThis vulnerability presents significant risk to confidentiality and integrity within affected Splunk Enterprise deployments, necessitating prompt remediation.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and improper sanitization within the Monitoring Console component of Splunk Enterprise when constructing dashboard searches from external parameters.\nThe affected component fails to adequately validate or encode user-supplied data used to build and execute underlying dashboard searches.\nAn unauthenticated attacker crafts a malicious URL pointing to the Monitoring Console, injecting arbitrary Search Processing Language (SPL) payloads into parameters processed by the vulnerable dashboard logic.\nThe attack vector requires user interaction; the attacker must successfully phish or otherwise trick a high-privileged user—specifically a user holding the 'admin' Splunk role—into opening the crafted link within an active authenticated session.\nUpon interaction by the privileged user, Splunk Enterprise processes the input and executes the attacker-controlled SPL commands utilizing the complete security privileges associated with the authenticated administrative session.\nThe execution of the injected SPL payload enables post-exploitation actions such as exposing sensitive data accessible to the administrator or modifying critical lookup tables.\nThe vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, requiring network exposure of the web interface combined with targeted social engineering to achieve exploitation."
}