In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute… (CVE-2026-76343)

CVE-2026-76343 is a SQL injection vulnerability in Splunk Enterprise's Data Orchestration jobs endpoint affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users lacking admin or power roles can exploit this by injecting SQL queries through job filter parameters, gaining unauthorized access to extensive data including other users' jobs and stored credentials. The root cause is the construction of database queries from user input without parameterized queries, violating secure coding practices.

An attacker with a non-admin, non-power Splunk role can execute arbitrary SQL queries, leading to unauthorized disclosure of sensitive data stored by Data Orchestration. This includes access to jobs owned by other users and stored connection credentials. The vulnerability does not affect integrity or availability but results in a high confidentiality impact.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to at least these versions to remediate the vulnerability. No vendor advisory was provided in the input, so check Splunk's official advisories for the latest patch and remediation guidance.