Description

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language (SPL) commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access all relevant data. The vulnerability does not affect Splunk Enterprise 10.4 versions and above. The vulnerability is possible because Splunk Web substitutes form token values supplied through the Uniform Resource Locator (URL) into SPL searches without neutralizing them. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Token reference (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/simple-xml-dashboards/10.2/simple-xml-reference/token-reference) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-19T22:17:19.807Z",
  "pubdate": "2026-08-19T22:17:19.807Z",
  "executiveSummary": "Splunk Enterprise contains an unauthenticated Search Processing Language (SPL) injection vulnerability within Splunk Web. The flaw allows an external attacker to construct a malicious Uniform Resource Locator containing crafted form token values that are dynamically substituted into SPL searches without proper neutralization. When an authenticated user interacts with the crafted link, arbitrary SPL commands are executed under the security context and permissions of that victim user. The primary impact of this vulnerability is unauthorized data access, as the injected SPL commands can query and retrieve all data accessible to the compromised user session. This security flaw affects Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, while versions 10.4 and above remain unaffected. Successful exploitation requires social engineering or phishing tactics to deceive an authenticated user into clicking and loading the malicious URL. Consequently, unauthenticated attackers cannot trigger the execution of arbitrary SPL commands at will without user interaction. The risk implication is significant within environments where users routinely access sensitive indices, as successful exploitation bypasses intended access boundaries via coerced administrative or high-privilege search execution.",
  "technicalDetails": "The vulnerability resides in the Splunk Web component of Splunk Enterprise, specifically within the mechanisms handling form token substitution supplied through parameters in the Uniform Resource Locator. The root cause of the vulnerability is insufficient input sanitization and a lack of neutralization logic when processing user-supplied form token values. Instead of validating, encoding, or escaping input before embedding parameters into queries, Splunk Web dynamically substitutes URL-supplied form token values directly into Search Processing Language searches. The affected software versions comprise Splunk Enterprise instances below 10.2.6, 10.0.9, and 9.4.14. The attack vector is web-based, utilizing network exposure via Splunk Web. Authentication requirements dictate that while the attacker initiating the payload is unauthenticated, the actual execution of the vulnerable search requires an active, authenticated user session. Privilege requirements leverage whatever search privileges and data access permissions are assigned to the victim user who opens the crafted link. The attack flow proceeds in a sequential manner: first, an unauthenticated attacker crafts a malicious URL targeting Splunk Web, embedding arbitrary SPL commands within form token parameter values. Second, the attacker executes a phishing campaign or social engineering vector to trick an authenticated Splunk Enterprise user into opening the crafted link. Third, the victim's browser sends the request to Splunk Web. Fourth, the vulnerable component processes the Uniform Resource Locator, extracting the unneutralized form token values and inserting them directly into the constructed SPL search string. Fifth, Splunk Enterprise executes the resulting query using the permissions of the authenticated victim user. The payload behavior forces the execution of arbitrary search commands capable of accessing all relevant data permitted by the user's role. Post-exploitation impact includes the potential exfiltration of sensitive operational data, logs, and internal system metrics accessible to the targeted user session."
}