Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute attacker-chosen Structured Query Language (SQL) queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stored by Data Orchestration, including jobs owned by other users and stored connection credentials. The vulnerability is possible because Data Orchestration builds a database query from user-controlled job filter values without using parameterized queries. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:17:19.023Z",
  "pubdate": "2026-08-19T22:17:19.023Z",
  "executiveSummary": "Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a critical SQL Injection vulnerability within the Data Orchestration jobs endpoint. This security flaw enables low-privileged users who lack 'admin' or 'power' Splunk roles to bypass role-based access controls and execute arbitrary, attacker-controlled SQL queries against the underlying database. The root cause stems from the application constructing database queries directly from user-supplied job filter values without leveraging parameterized queries or proper input sanitization. Successful exploitation grants attackers unauthorized read and write access to substantially all data stored within Data Orchestration. This includes sensitive information such as jobs owned by other users and securely stored connection credentials, severely compromising confidentiality and integrity. The attack requires authenticated access to the vulnerable Splunk Enterprise instance but bypasses standard administrative role restrictions, enabling unauthorized data exfiltration and credential theft across multi-tenant or shared enterprise deployments.",
  "technicalDetails": "The vulnerability resides in the Data Orchestration component of Splunk Enterprise, specifically within the jobs endpoint handling user-submitted job filter values. The root cause of the vulnerability is the unsafe construction of SQL queries where user-controlled input parameters are dynamically concatenated directly into the query string instead of utilizing parameterized queries or prepared statements. Because of this improper input handling, an authenticated user possessing standard, low-privileged roles—explicitly lacking the 'admin' or 'power' Splunk roles—can inject malicious SQL syntax into the job filter parameters. When the Data Orchestration endpoint processes the request, the database interprets the injected input as executable SQL commands, allowing the attacker to manipulate the query logic, bypass application-level filtering, and execute arbitrary SQL commands. The step-by-step attack flow begins with an authenticated low-privileged user crafting a malicious HTTP request directed at the Data Orchestration jobs endpoint. Within this request, the user supplies specially crafted payload strings inside the job filter parameters designed to alter the syntax of the backend database query. Upon receiving the request, the vulnerable component interpolates the untrusted input directly into the SQL execution string and dispatches it to the database engine. The database executes the resulting malicious query, exposing unauthorized datasets. Post-exploitation impact includes the retrieval of substantially all data stored by Data Orchestration, unauthorized access to jobs owned by other users, and the exposure of sensitive stored connection credentials. The affected versions include Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Exploitation requires authentication to the platform, but can be performed by any user without administrative or power privileges, as the vulnerable endpoint fails to properly enforce role-based access controls against the underlying data operations."
}