CVE-2026-76331: Splunk Enterprise Auth Bypass Vulnerability

CVE-2026-76331 Overview

CVE-2026-76331 is a Search Processing Language (SPL) injection vulnerability in Splunk Enterprise. The flaw exists in saved-search dispatch handling, where the product fails to validate caller-supplied time values before using them in search construction. A low-privileged authenticated user without the admin or power role can inject SPL into dispatch requests. Successful exploitation allows unauthorized access to indexed data and impacts system integrity. The vulnerability is classified under [CWE-943: Improper Neutralization of Special Elements in Data Query Logic].

Critical Impact
Authenticated low-privileged users can inject arbitrary SPL through saved-search dispatch time parameters, gaining unauthorized read access to all relevant data and compromising integrity of Splunk Enterprise deployments.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6 and below 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76331 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76331

Vulnerability Analysis

The vulnerability resides in the saved-search dispatch mechanism exposed through the Splunk REST search endpoints. When a user dispatches a saved search, the request accepts caller-controlled time modifiers such as dispatch.earliest_time and dispatch.latest_time. Splunk Enterprise concatenates these values into the resulting SPL query without adequately validating their contents. An attacker supplies crafted time values that break out of the intended parameter context and inject additional SPL operators, pipes, or commands into the executed search.

Because SPL controls both data retrieval and transformation across indexes, a successful injection expands the caller's effective query scope. The attacker can read events across indexes they would not otherwise be able to query and can chain search commands that modify results returned to downstream consumers. The account performing the request only requires authenticated API access; the admin and power roles are not required.

Root Cause

The root cause is improper neutralization of special elements in data query logic (CWE-943). Splunk Enterprise treats the time parameters submitted to saved-search dispatch as trusted input and does not enforce a strict type or grammar before splicing them into the search string. This allows injected SPL fragments to be parsed and executed as part of the saved search.

Attack Vector

Exploitation requires network access to the Splunk management interface and valid credentials for any authenticated role other than admin or power. The attacker issues a POST request to a saved-search dispatch endpoint and places SPL payload content inside a time parameter. The Splunk search pipeline then compiles and executes the resulting query under the caller's session, returning injected data or side effects to the response. No user interaction is required. Refer to the Splunk Security Advisory SVD-2026-0801 for vendor technical details.

Detection Methods for CVE-2026-76331

Indicators of Compromise

Saved-search dispatch requests from non-admin, non-power users containing SPL metacharacters such as |, backticks, or embedded search commands in dispatch.earliest_time or dispatch.latest_time parameters.
audit.log and _internal search history entries showing dispatched searches with unusual time-range strings that do not parse as standard time modifiers.
Cross-index search activity originating from user accounts that historically only query a limited set of indexes.

Detection Strategies

Parse Splunk internal search audit events and alert when dispatch time fields contain characters outside a strict allow-list of digits, -, +, @, d, h, m, s, w, y, and now.
Baseline saved-search dispatch behavior per role and flag deviations where low-privileged roles trigger searches spanning unexpected indexes or sourcetypes.
Correlate REST API traffic against user role assignments to identify SPL execution paths inconsistent with the caller's role capabilities.

Monitoring Recommendations

Forward Splunk _audit and _internal indexes to an external SIEM to preserve tamper-evident logs of search dispatch activity.
Monitor outbound data volumes from search head endpoints for anomalies that may indicate mass data extraction via injected SPL.
Track authentication events and API token usage for non-admin accounts calling saved-search dispatch endpoints at abnormal rates.

How to Mitigate CVE-2026-76331

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later according to your deployed branch.
Audit user role assignments and remove REST API access from accounts that do not require programmatic search dispatch.
Review recent saved-search dispatch activity in _audit logs for signs of SPL injection prior to patching.

Patch Information

Splunk has released fixed versions addressing CVE-2026-76331. Deploy Splunk Enterprise 10.4.2, 10.2.6, 10.0.9, or 9.4.14. Full remediation details are available in the Splunk Security Advisory SVD-2026-0801 and the Splunk search endpoint documentation.

Workarounds

Restrict network access to the Splunk management port (default 8089) to trusted administrative networks only.
Limit the set of users granted any role capable of invoking saved-search dispatch until patches are applied.
Disable or remove saved searches owned by low-privileged users where operationally feasible while the upgrade is scheduled.

bash

# Configuration example: restrict management port access via Splunk web.conf / server.conf
# server.conf
[general]
# Bind management port to loopback and rely on a reverse proxy for authenticated admin access
mgmtHostPort = 127.0.0.1:8089

# authorize.conf - review and constrain roles that can dispatch searches
[role_analyst]
srchIndexesAllowed = index_app_logs
srchIndexesDefault = index_app_logs
schedule_search = disabled
dispatch_rest_to_indexers = disabled