In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles… (CVE-2026-76309)

CVE-2026-76309 describes a SQL injection vulnerability in Splunk Enterprise affecting versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Low-privileged users lacking admin or power roles can exploit the REST API by injecting SQL commands via user-supplied filter parameters. The REST API incorporates these parameters into database queries without proper sanitization, enabling injection. This vulnerability is categorized under CWE-89 and has a CVSS 3.1 base score of 4.3 (medium severity). No known exploits in the wild or official patches are referenced in the provided data.

The vulnerability allows low-privileged users to perform SQL injection via the REST API, potentially leading to unauthorized disclosure of limited data (confidentiality impact is low). There is no impact on integrity or availability reported. The overall impact is moderate given the limited privileges required and the low confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the REST API to trusted users and monitor for unusual activity related to API usage. Avoid granting unnecessary roles to users to reduce exposure.