Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could access data and perform actions available to that user. The vulnerability is possible because Monitoring Console does not sufficiently validate data used to build forwarder dashboard searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T22:17:17.297Z",
  "pubdate": "2026-08-19T22:17:17.297Z",
  "executiveSummary": "Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a Search Processing Language (SPL) injection vulnerability within the Monitoring Console component. This security flaw allows an unauthenticated remote attacker to craft malicious links designed to target authenticated users through social engineering tactics such as phishing.\nUpon successful exploitation, when an authenticated user interacts with the crafted link, the Monitoring Console executes arbitrary attacker-controlled SPL queries utilizing the victim's active session permissions. This grants the attacker unauthorized access to sensitive data and the capability to execute actions permitted by the victim's access control level.\nThe risk implication centers on unauthorized data exposure and privilege abuse via indirect code execution. While direct exploitation by an unauthenticated attacker is precluded, the reliance on user interaction via phishing creates a significant vector for compromise across affected deployments. Organizations utilizing Splunk Enterprise must remediate the issue to prevent unauthorized data retrieval and integrity compromise.",
  "technicalDetails": "The vulnerability resides within the Monitoring Console component of Splunk Enterprise, specifically stemming from insufficient input validation of parameters utilized to construct forwarder dashboard searches. Due to this inadequate sanitization, the application fails to safely process external data inputs, allowing the embedding of arbitrary Search Processing Language (SPL) commands.\nThe attack flow requires an unauthenticated attacker to construct a specially crafted URL targeting the vulnerable Monitoring Console endpoint. Because the unauthenticated attacker cannot exploit the vulnerability autonomously, they must leverage a phishing vector to trick an authenticated Splunk Enterprise user into clicking or navigating to the malicious link within their active browser session.\nWhen the authenticated victim opens the crafted link, the Monitoring Console processes the malicious parameters without proper validation, causing the application to dynamically generate and execute attacker-controlled SPL queries. The execution occurs entirely within the context and authorization level of the victim's session, bypassing direct authentication barriers for the injected payload.\nThe scope of impact and post-exploitation behavior depend directly on the victim's assigned privileges within Splunk Enterprise. If the targeted user possesses administrative or elevated privileges, the injected SPL can access sensitive operational data, internal indices, and perform administrative actions available to that user.\nAffected software versions include Splunk Enterprise instances below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability involves web-based interaction over the network, requiring a victim with an active session to trigger the processing of the unvalidated input parameters."
}