Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language (SPL) commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user opens the dataset in the Table Editor. The commands run using the permissions of the second user and could expose all relevant data and modify lookup files. The vulnerability is possible because the Table Editor does not apply SPL safeguards for risky commands to the field-summary search that it runs for the Initial Data step. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T22:17:18.890Z",
  "pubdate": "2026-08-19T22:17:18.890Z",
  "executiveSummary": "A privilege escalation vulnerability exists in Splunk Enterprise that allows a low-privileged user to execute arbitrary Search Processing Language (SPL) commands with the elevated privileges of an administrator. The vulnerability resides in the Table Editor component, which fails to properly enforce SPL safeguards for risky commands during the field-summary search executed in the Initial Data step. Affected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAn attacker assigned the 'power' Splunk role can store malicious and risky SPL commands inside a Table Editor dataset and share it with other users. If an 'admin' user opens the shared dataset within the Table Editor, the embedded SPL commands automatically execute under the administrative user's security context. This unintended execution occurs via a cross-user trigger mechanism that requires the attacker to phish the administrative target by tricking them into initiating a browser-based request. Successful exploitation does not allow the attacker to execute the vulnerability autonomously at will, but successfully compromises the confidentiality and integrity of the system by exposing sensitive operational data and modifying lookup files.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and a bypass of security controls within the Table Editor component of Splunk Enterprise. Specifically, the Table Editor fails to apply standard SPL safeguards designed to restrict risky commands during the execution of the field-summary search utilized in the Initial Data step of dataset processing.\nThe attack lifecycle initiates when an authenticated user assigned the 'power' Splunk role crafts a malicious dataset containing unauthorized or risky SPL commands within the Table Editor. The attacker then shares this dataset across the platform. Because the underlying vulnerability permits the encapsulation of arbitrary SPL logic without triggering built-in restriction policies, the malicious payload persists within the dataset definition.\nTo trigger the execution phase, the attacker must employ social engineering tactics, specifically phishing the targeted user holding the 'admin' Splunk role to trick them into interacting with a crafted browser-based request. When the administrative user opens the shared dataset in the Table Editor, the application automatically initiates the Initial Data step and executes the field-summary search. Because the operation runs within the active browser session of the administrator, the embedded SPL commands inherit the full functional capabilities and administrative privileges of the victim.\nThe post-exploitation impact includes unauthorized data exposure, as the execution of the injected SPL commands can extract and expose all relevant data accessible to the administrator. Additionally, the compromised execution context allows for unauthorized data modification, specifically granting the attacker the ability to alter and tamper with critical system lookup files. Authentication is required at the 'power' role level to author the payload and at the 'admin' role level to inadvertently execute it, while network exposure aligns with the standard operational access mechanisms of the Splunk Enterprise web interface."
}