CVE-2026-76267: The software does not neutralize or incorrectly neutralizes output that is written to logs. in Splunk Splunk Enterprise

In Splunk Enterprise versions >=10.0 <10.0.10, >=10.2 <10.2.7, and >=10.4 <10.4.3, a vulnerability exists where the Splunk App for Splunk O11y Cloud does not properly neutralize user-supplied SignalFlow content before writing it to the app log. This allows users with the read_o11y_content capability to inject forged log entries through the REST API. Versions 9.4.x are confirmed not vulnerable.

An attacker with the read_o11y_content capability can inject forged entries into application logs, potentially misleading log analysis or auditing processes. There is no impact on confidentiality or availability, only integrity of log data is affected.

Upgrading to Splunk Enterprise versions 10.4.3, 10.2.7, or 10.0.10 or later addresses this vulnerability. Since these fixed versions are explicitly stated, applying these official fixes is recommended.