CVE-2026-76343

Summary

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute attacker-chosen Structured Query Language (SQL) queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stored by Data Orchestration, including jobs owned by other users and stored connection credentials. The vulnerability is possible because Data Orchestration builds a database query from user-controlled job filter values without using parameterized queries. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.

Affected Software

Weaknesses

• CWE-89: The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Workarounds

Turn off the PostgreSQL sidecar service by setting disabled = true in the [postgres] stanza in the server.conf configuration file if you do not use Edge Processor, OpAmp, or Search Processing Language 2 (SPL2) data pipelines. For more information see Sidecar configuration settings in the Splunk documentation. Note: Turning off the PostgreSQL sidecar service breaks these features and can affect dependent sidecar processes.

References

• https://advisory.splunk.com/advisories/SVD-2026-0801

• ←Previous
• Next→