CVE-2026-76270: The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. in Splunk Splunk Enterprise

Splunk Enterprise versions >=10.4 and <10.4.3 contain a SQL injection vulnerability due to failure to properly parameterize user-supplied input in SPL2 module filtering database queries. A user with the list_spl2_modules capability can exploit this to access all relevant data accessible through the affected REST API, including private SPL2 module definitions belonging to other users. The vulnerability arises because special elements in the input are not neutralized, allowing modification of the intended SQL command.

An attacker with the list_spl2_modules capability can leverage this vulnerability to perform SQL injection attacks, resulting in unauthorized read access to sensitive data, specifically private SPL2 module definitions of other users. The CVSS score of 6.5 (medium severity) reflects the network attack vector, low attack complexity, and high confidentiality impact without integrity or availability impact.

Splunk Enterprise versions 10.4.3 and later include a fix for this vulnerability. Users should upgrade to version 10.4.3 or later to remediate the issue. Since this is not a cloud service, remediation requires applying the official patch. No other mitigation steps are indicated in the vendor advisory.