Description

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mc_investigation_read capability could inject Search Processing Language (SPL) through Analyst Queue search filters, allowing for access to all relevant data and system integrity available to the scheduled searches that run for that user. The vulnerability is possible because the Analyst Queue search filter handling does not validate filter field names before the fields are included in SPL searches. For more information see Users and roles for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/install/8.4/installation/users-and-roles-for-splunk-enterprise-security), Manage analyst workflows using the analyst queue in Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.4/mission-control/manage-analyst-workflows-using-the-analyst-queue-in-splunk-enterprise-security), and Overview of Mission Control in Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.5/mission-control/overview-of-mission-control-in-splunk-enterprise-security) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T22:17:24.953Z",
  "pubdate": "2026-08-19T22:17:24.953Z",
  "executiveSummary": "Splunk Enterprise Security versions below 8.6.1 contain a Search Processing Language (SPL) injection vulnerability within the Analyst Queue search filter handling mechanism.\nThe vulnerability arises due to insufficient validation of filter field names before they are dynamically incorporated into SPL search queries executed by the system.\nAn authenticated user assigned a Splunk Enterprise Security role containing the mc_investigation_read capability can exploit this flaw to inject arbitrary SPL commands through Analyst Queue search filters.\nSuccessful exploitation allows an attacker to bypass intended data access restrictions, gaining unauthorized access to sensitive operational data and compromising system integrity associated with the scheduled searches executed under the user's security context.\nThe attack requires authentication and specific role capabilities within the application, lowering the external attack surface but presenting significant internal risk regarding unauthorized data exposure and privilege escalation through query manipulation.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper input validation and sanitization of filter field names processed by the Analyst Queue search filter component within Splunk Enterprise Security.\nWhen a user interacts with the Analyst Queue, filter parameters supplied via the interface are appended directly or constructed improperly into internal Search Processing Language (SPL) queries without adequate sanitization or structural validation.\nAn attacker possessing a role with the mc_investigation_read capability can manipulate these filter field names to inject malicious SPL syntax into the query string.\nThe attack flow proceeds as follows: First, the authenticated user navigates to or interacts with the Analyst Queue interface where search filters are applied. Second, the user crafts a malicious input string containing raw SPL commands disguised as or appended to a filter field name. Third, the vulnerable application component fails to validate the filter field name and dynamically interpolates the malicious input into the underlying SPL search query. Finally, when the search is executed—often within the context of scheduled searches or automated background processes tied to that user—the injected SPL executes, altering the intended logic of the query.\nThis execution model allows the attacker to read data outside their authorized scope, access restricted indices, or manipulate system integrity depending on the permissions granted to the scheduled searches running for that user.\nThe vulnerable component is the Analyst Queue search filter handling logic in Splunk Enterprise Security versions below 8.6.1.\nPrerequisites for exploitation include valid user authentication and the assignment of a Splunk Enterprise Security role containing the mc_investigation_read capability."
}