CVE-2026-76339
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user without admin or power roles could inject arbitrary SPL commands through the geostats command. The injected SPL runs with the permissions of another authenticated user after that user initiates the attacker-controlled geostats search. The vulnerability is due to insufficient input validation.
Risk Assessment
The risk includes unauthorized access to data and credentials, and modification of lookup files, potentially leading to data confidentiality and integrity breaches.
Recommendation
Upgrade Splunk Enterprise to 10.4.2 or later and restrict permissions for users without admin/power roles. Educate users about the risk of opening suspicious searches.
Original NVD description (English source)
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject arbitrary Search Processing Language (SPL) commands through the geostats command. The injected SPL runs with the permissions of another authenticated user after that user initiates the attacker-controlled geostats search in Splunk Web. The injected SPL could expose all relevant data available to the second user, including stored credentials, and modify lookup files that the second user has permission to change. The vulnerability is possible because the geostats command does not sufficiently validate input before Splunk Enterprise processes it. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who does not hold the "admin" or "power" Splunk roles should not be able to exploit the vulnerability at will. For more information see geostats (https://help.splunk.com/en/splunk-enterprise/spl-search-reference/10.0/search-commands/geostats) in the Splunk documentation.