CVE-2026-76343

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76343", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2026-08-19T12:02:03.627Z", "datePublished": "2026-08-19T21:34:40.632Z", "dateUpdated": "2026-08-26T15:21:10.540Z"}, "containers": {"cna": {"affected": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"version": "10.4", "status": "affected", "versionType": "custom", "lessThan": "10.4.2"}, {"version": "10.2", "status": "affected", "versionType": "custom", "lessThan": "10.2.6"}, {"version": "10.0", "status": "affected", "versionType": "custom", "lessThan": "10.0.9"}, {"version": "9.4", "status": "affected", "versionType": "custom", "lessThan": "9.4.14"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/markdown", "value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the \"admin\" or \"power\" Splunk roles could execute attacker-chosen Structured Query Language (SQL) queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stored by Data Orchestration, including jobs owned by other users and stored connection credentials. The vulnerability is possible because Data Orchestration builds a database query from user-controlled job filter values without using parameterized queries. For more information see [About configuring role-based user access](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation."}], "value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the \"admin\" or \"power\" Splunk roles could execute attacker-chosen Structured Query Language (SQL) queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stored by Data Orchestration, including jobs owned by other users and stored connection credentials. The vulnerability is possible because Data Orchestration builds a database query from user-controlled job filter values without using parameterized queries. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0801"}], "title": "Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise", "datePublic": "2026-08-19T00:00:00.000Z", "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-89", "description": "The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component."}]}], "source": {"advisory": "SVD-2026-0801"}, "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-08-19T21:34:40.632Z"}, "solutions": [{"lang": "en", "value": "Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher."}], "workarounds": [{"lang": "en", "value": "Turn off the PostgreSQL sidecar service by setting disabled = true in the [postgres] stanza in the server.conf configuration file if you do not use Edge Processor, OpAmp, or Search Processing Language 2 (SPL2) data pipelines. For more information see [Sidecar configuration settings](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Note: Turning off the PostgreSQL sidecar service breaks these features and can affect dependent sidecar processes."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T14:49:42.662307Z", "id": "CVE-2026-76343", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T15:21:10.540Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76343", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T14:49:42.662307Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T14:49:43.995Z"}}], "cna": {"title": "Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise", "source": {"advisory": "SVD-2026-0801"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.4", "lessThan": "10.4.2", "versionType": "custom"}, {"status": "affected", "version": "10.2", "lessThan": "10.2.6", "versionType": "custom"}, {"status": "affected", "version": "10.0", "lessThan": "10.0.9", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.14", "versionType": "custom"}]}], "solutions": [{"lang": "en", "value": "Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher."}], "datePublic": "2026-08-19T00:00:00.000Z", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0801"}], "workarounds": [{"lang": "en", "value": "Turn off the PostgreSQL sidecar service by setting disabled = true in the [postgres] stanza in the server.conf configuration file if you do not use Edge Processor, OpAmp, or Search Processing Language 2 (SPL2) data pipelines. For more information see [Sidecar configuration settings](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation. Note: Turning off the PostgreSQL sidecar service breaks these features and can affect dependent sidecar processes."}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the \"admin\" or \"power\" Splunk roles could execute attacker-chosen Structured Query Language (SQL) queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stored by Data Orchestration, including jobs owned by other users and stored connection credentials. The vulnerability is possible because Data Orchestration builds a database query from user-controlled job filter values without using parameterized queries. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.", "supportingMedia": [{"type": "text/markdown", "value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the \"admin\" or \"power\" Splunk roles could execute attacker-chosen Structured Query Language (SQL) queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stored by Data Orchestration, including jobs owned by other users and stored connection credentials. The vulnerability is possible because Data Orchestration builds a database query from user-controlled job filter values without using parameterized queries. For more information see [About configuring role-based user access](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-89", "description": "The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component."}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-08-19T21:34:40.632Z"}}}, "cveMetadata": {"cveId": "CVE-2026-76343", "state": "PUBLISHED", "dateUpdated": "2026-08-26T15:21:10.540Z", "dateReserved": "2026-08-19T12:02:03.627Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-08-19T21:34:40.632Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"lessThan": "10.4.2", "status": "affected", "version": "10.4", "versionType": "custom"}, {"lessThan": "10.2.6", "status": "affected", "version": "10.2", "versionType": "custom"}, {"lessThan": "10.0.9", "status": "affected", "version": "10.0", "versionType": "custom"}, {"lessThan": "9.4.14", "status": "affected", "version": "9.4", "versionType": "custom"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "E180CC4C-5B8B-4D69-8535-93DCF3510119", "versionEndExcluding": "9.4.14", "versionStartIncluding": "9.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "0FD75354-A6EE-49F9-9B8A-31287A845CFB", "versionEndExcluding": "10.0.9", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C8FDA841-04BC-404C-B56D-7869CBD8B56C", "versionEndExcluding": "10.2.6", "versionStartIncluding": "10.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "209C1DE6-893D-424D-B103-B64A314AD8DC", "versionEndExcluding": "10.4.2", "versionStartIncluding": "10.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the \"admin\" or \"power\" Splunk roles could execute attacker-chosen Structured Query Language (SQL) queries through the Data Orchestration jobs endpoint, allowing for access to substantially all data stored by Data Orchestration, including jobs owned by other users and stored connection credentials. The vulnerability is possible because Data Orchestration builds a database query from user-controlled job filter values without using parameterized queries. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation."}], "id": "CVE-2026-76343", "lastModified": "2026-08-26T16:16:40.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76343", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T14:49:42.662307Z", "version": "2.0.3"}}]}, "published": "2026-08-19T22:17:19.023", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://advisory.splunk.com/advisories/SVD-2026-0801"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.4,10.4.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.2,10.2.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[10.0,10.0.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9.4,9.4.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Splunk Enterprise", "source": "cna", "vendor": "Splunk"}, "product": "splunk_enterprise", "vendor": "splunk"}], "created": "2026-08-19T23:00:13.543681+00:00", "updated": "2026-08-20T10:15:17.227775+00:00", "vendors": ["splunk", "splunk$PRODUCT$splunk_enterprise"]}