Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Analytics Workspace. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language (SPL) using the permissions of that user. The injected SPL could access data and perform actions available to that user. The vulnerability is possible because Analytics Workspace does not sufficiently validate data used to build searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T22:17:17.550Z",
  "pubdate": "2026-08-19T22:17:17.550Z",
  "executiveSummary": "Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain an input validation vulnerability within the Analytics Workspace component that leads to Search Processing Language (SPL) injection.\nAn unauthenticated attacker can leverage this flaw to construct a malicious, crafted link designed to trick an authenticated user into executing arbitrary SPL queries within the context of their active session privileges.\nThe primary impact of successful exploitation includes unauthorized data access and the execution of arbitrary actions authorized to the victim user.\nThe risk implication is significant as it bridges the gap between unauthenticated external entities and internal data processing capabilities via client-side interaction.\nAttacker capabilities are constrained by the permissions of the targeted authenticated user, requiring successful social engineering or phishing tactics to induce the victim into opening the crafted link.\nThe vulnerability cannot be exploited autonomously at will by an unauthenticated user without user interaction.",
  "technicalDetails": "The root cause of the vulnerability resides in the Analytics Workspace component of Splunk Enterprise, which fails to sufficiently validate and sanitize external data parameters used programmatically to construct search queries.\nBecause the input parsing mechanism lacks rigorous validation, malicious input parameters can be injected via crafted Uniform Resource Locators (URLs) and interpreted as executable Search Processing Language (SPL).\nThe vulnerable component is the Analytics Workspace interface, affecting Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious link targeting the Analytics Workspace containing embedded, attacker-controlled SPL payloads. Second, the attacker employs phishing techniques to trick an authenticated Splunk Enterprise user into clicking and opening the crafted link within their browser. Third, when the authenticated user opens the link, the Splunk Enterprise web application processes the request using the victim's active session. Fourth, the Analytics Workspace fails to validate the supplied data, dynamically generating and executing the attacker-controlled SPL commands utilizing the privileges of the victim user. Finally, the injected SPL executes post-exploitation behaviors, allowing the unauthorized retrieval of sensitive data and execution of actions permitted under the victim's access control scope.\nNetwork exposure involves the web interface of Splunk Enterprise accessible to authenticated users, while the initial vector relies on external unauthenticated delivery via phishing.\nAuthentication and privilege requirements for the execution phase dictate that the victim must be an authenticated user with an active session, while the attacker initiates the sequence unauthenticated via the crafted link."
}