CVE-2026-76309: The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. in Splunk Splunk Enterprise

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a vulnerability where the REST API incorporates user-supplied filter values into SQL queries without proper neutralization. This allows low-privileged users lacking admin or power roles to inject SQL commands, causing the system to evaluate attacker-controlled text as part of a database query. The vulnerability is identified as CVE-2026-76309 with a CVSS 3.1 base score of 4.3, indicating medium severity.

An attacker with low privileges can perform SQL injection via the REST API, potentially influencing database queries. The impact is limited to confidentiality (low impact) with no integrity or availability impact reported. No known exploits are currently in the wild.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation guidance is provided by the vendor advisory.