CVE-2026-76343: Splunk Enterprise SQL Injection Vulnerability

CVE-2026-76343 Overview

CVE-2026-76343 is a SQL injection vulnerability [CWE-89] in Splunk Enterprise. Low-privileged users without the admin or power roles can execute attacker-chosen Structured Query Language (SQL) queries through the Data Orchestration jobs endpoint. Successful exploitation exposes substantially all data stored by Data Orchestration, including jobs owned by other users and stored connection credentials. The flaw affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Splunk addressed the issue in advisory SVD-2026-0801.

Critical Impact
Authenticated low-privilege users can read cross-tenant Data Orchestration jobs and exfiltrate stored connection credentials via injected SQL.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6 and 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76343 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76343

Vulnerability Analysis

The vulnerability resides in the Data Orchestration jobs endpoint of Splunk Enterprise. Data Orchestration constructs database queries by concatenating user-supplied job filter values directly into SQL statements. Because the code path does not use parameterized queries, an authenticated user can inject arbitrary SQL clauses through filter parameters.

Exploitation does not require the admin or power Splunk role. Any authenticated user able to reach the Data Orchestration jobs endpoint can trigger the injection. The confidentiality impact is high because Data Orchestration stores connection credentials used to reach external data sources.

The vulnerability is network-reachable and requires low attack complexity. Integrity and availability are not directly impacted, but exposed credentials can be reused for lateral movement into connected databases and services.

Root Cause

The root cause is unsafe SQL query construction. Splunk's Data Orchestration component builds SQL statements from user-controlled job filter values through string concatenation instead of prepared statements with bound parameters. This is a classic [CWE-89] pattern where trust boundaries between authenticated users and stored data owned by other users are enforced only by the intended query logic, which the injection subverts.

Attack Vector

An authenticated attacker sends a crafted request to the Data Orchestration jobs endpoint with malicious payloads embedded in job filter parameters. The injected SQL executes with the privileges of the Data Orchestration database context and returns rows from any accessible table. Because role-based access control is enforced at the application layer rather than at the database query layer, cross-user job data and stored credential records are reachable.

See the Splunk Security Advisory SVD-2026-0801 for full technical details.

Detection Methods for CVE-2026-76343

Indicators of Compromise

Unexpected requests to the Data Orchestration jobs endpoint from accounts that do not hold the admin or power role.
Job filter parameters containing SQL metacharacters such as single quotes, UNION, --, or ;.
Anomalous read volumes of Data Orchestration jobs or connection credential records from a single low-privileged user.

Detection Strategies

Enable audit logging on the Data Orchestration jobs endpoint and alert on parameter values containing SQL syntax tokens.
Correlate authenticated Splunk sessions with database query patterns to flag deviations from expected job filter workloads.
Baseline per-user access to Data Orchestration jobs and generate alerts when a user retrieves jobs owned by other principals.

Monitoring Recommendations

Forward Splunk Enterprise access logs and Data Orchestration audit events to a centralized SIEM for retention and cross-source correlation.
Monitor for outbound connections from hosts holding Data Orchestration credentials to identify credential reuse after suspected exposure.
Track version inventory to ensure all Splunk Enterprise instances are running fixed builds.

How to Mitigate CVE-2026-76343

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later per the fixed version applicable to your deployment branch.
Review role assignments and remove Data Orchestration access from users who do not require it, following About configuring role-based user access.
Rotate any credentials stored in Data Orchestration connections if exposure is suspected.

Patch Information

Splunk released fixes in Splunk Enterprise 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Refer to Splunk Security Advisory SVD-2026-0801 for build details and upgrade guidance.

Workarounds

Restrict access to the Data Orchestration jobs endpoint at the network or reverse-proxy layer until patching is complete.
Limit which roles can invoke Data Orchestration features by tightening authorize.conf capabilities.
Rotate stored connection credentials on a defined schedule and prefer short-lived credentials where supported.

bash

# Example: verify installed Splunk version before and after upgrade
$SPLUNK_HOME/bin/splunk version

# Restart Splunk after applying the upgrade package
$SPLUNK_HOME/bin/splunk restart