SQL Injection Vulnerability in Splunk Enterprise Affecting User Data

CVE-2026-76270

What is CVE-2026-76270?

In earlier versions of Splunk Enterprise, a security flaw exists that allows users with specific roles to exploit SQL injection in SPL2 module filtering. This flaw enables unauthorized access to sensitive data via the affected REST API, including access to private SPL2 module definitions owned by other users. The vulnerability arises due to the lack of proper parameterization for user-supplied values in database queries related to SPL2 module filtering. For more detailed information, consult the Splunk documentation on managing SPL2 modules and module permissions.

References