Threats Tagged 'cve-2026-76254'

Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise, specifiek in versies vóór 10.4.2, 10.2.6, 10.0.9 en 9.4.14.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant data and system integrity available to that user and affect system availability. The vulnerability is possible because Dataset Explorer does not validate or escape dataset names before building SPL searches and does not apply SPL safeguards for risky commands to those searches. The vulnerability requires the attacker to phish the user by tricking them into opening the crafted link. The unauthenticated user should not be able to exploit the vulnerability at will. For more information see Explore a dataset (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/10.4/manage-and-explore-datasets/explore-a-dataset) and SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands) in the Splunk documentation.

CVE-2026-76254 is a high-severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14. It allows an unauthenticated attacker to cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines with that user's privileges via Dataset Explorer. This occurs because Dataset Explorer fails to properly validate or escape dataset names and does not apply SPL safeguards for risky commands. Exploitation requires phishing the victim to open a crafted link, so the attacker cannot exploit it at will. The vulnerability impacts data confidentiality, integrity, and system availability.