In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled… (CVE-2026-76341)

In affected Splunk Enterprise versions, a user holding the "power" role can embed malicious SPL commands in a Table Editor dataset. When an admin user opens this dataset, the embedded SPL runs with the admin's permissions, potentially exposing all relevant data and allowing limited modification on the search head. This occurs because the Table Editor fails to apply SPL safeguards for risky commands when preparing initial dataset data. Exploitation requires social engineering to trick an admin user into opening the malicious dataset, triggering the SPL execution. The vulnerability is tracked as CVE-2026-76341 and has a CVSS 3.1 score of 5.4 (medium severity).

Successful exploitation can lead to exposure of sensitive data accessible by the admin user and limited modification of data on the Splunk search head. The attacker requires a user with the "power" role to create the malicious dataset and an admin user to open it, which involves user interaction (phishing). The vulnerability does not allow privilege escalation by the "power" user alone but leverages the admin user's permissions when the malicious dataset is opened.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict the ability to create or share Table Editor datasets to trusted users only. Educate admin users to avoid opening datasets from untrusted sources and be cautious of phishing attempts. Monitor Splunk role assignments to ensure the "power" role is granted only to trusted users. Follow Splunk's guidance on SPL safeguards for risky commands and role definitions to minimize risk.