CVE-2026-76270
Splunk: SQL injection
- Risk score
- 42/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer (REST) API, including private SPL2 module definitions belonging to other…
- Affected
- Splunk
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Splunk: Amber, patch this week. In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible bec…
The flaws
- CVE-2026-76270: SQL injection (CVSS 6.5 · EPSS 0%)
- CVE-2026-76268: Missing authentication (CVSS 9.8 · EPSS 2%)
- CVE-2026-76284: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has… (CVSS 9.8 · EPSS 0%)
- CVE-2026-76285: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has… (CVSS 9.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Splunk
Where it stands
- No known exploitation
Connects to
- Same weakness: SQL injection (CWE-89). 399 other warnings in 30 days
- Same product: Earlier Splunk warnings. 18 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
References
Original description
In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer (REST) API, including private SPL2 module definitions belonging to other users. The vulnerability is possible because Splunk Enterprise and Splunk Cloud Platform do not parameterize user-supplied values before using them in database queries for SPL2 module filtering. For more information see Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) and Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) in the Splunk documentation. Splunk Enterprise versions 10.2.x, 10.0.x, and 9.4.x are not affected.
Last activity 7 Oct 2026. Patch Forecast updates every hour.