Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system integrity within Splunk Enterprise. The vulnerability is possible because Splunk Enterprise does not correctly validate caller-supplied time values before using them in saved-search dispatch. For more information see Search endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.2/search-endpoints/search-endpoint-descriptions) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T22:17:17.423Z",
  "pubdate": "2026-08-19T22:17:17.423Z",
  "executiveSummary": "A Search Processing Language (SPL) injection vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe flaw allows users lacking the \"admin\" or \"power\" Splunk roles to inject arbitrary SPL into saved-search dispatch requests.\nSuccessful exploitation can result in unauthorized access to sensitive operational data and compromise system integrity within the Splunk Enterprise deployment.\nThe root cause stems from insufficient validation of caller-supplied time values prior to their utilization in saved-search dispatch operations.\nAttackers require low-privileged user capabilities to interact with the affected search endpoint, bypassing intended role-based access control boundaries.",
  "technicalDetails": "The vulnerability resides within the saved-search dispatch handling mechanisms of Splunk Enterprise, specifically in how caller-supplied time values are processed.\nAffected versions include Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe root cause is improper input validation where the application fails to correctly sanitize or validate time-related parameters provided by the caller during saved-search dispatch requests.\nAn authenticated user lacking administrative or power privileges can craft a malicious request targeting the saved-search dispatch functionality.\nBy manipulating the unvalidated time values, the attacker injects arbitrary Search Processing Language (SPL) commands into the execution flow.\nDuring the attack flow, the malicious input is processed by the search endpoint without adequate constraints, allowing the injected SPL to execute with broader permissions than those assigned to the user's role.\nThis circumvents authorization checks tied to the search dispatch mechanism, granting unauthorized access to all relevant indexed data accessible to higher-privileged contexts.\nPost-exploitation impact includes severe breaches of confidentiality and integrity, as unauthorized data exfiltration and unauthorized search operations can be executed against the underlying system."
}