Threats Tagged 'cve-2026-76342'

In certain versions of Splunk Enterprise prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user with the "power" role can store risky Search Processing Language (SPL) commands in a Table Editor dataset and share it. When a user with the "admin" role opens this dataset, the stored commands execute with the admin's permissions, potentially exposing sensitive data and modifying lookup files. This occurs because the Table Editor does not apply SPL safeguards to the field-summary search during the Initial Data step. Exploitation requires phishing an admin user to open the crafted dataset in their browser. The vulnerability is rated medium severity with a CVSS score of 5.4.

CVE-2026-76342 is a medium severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It involves improper authorization checks allowing a user with the "power" role to embed risky SPL commands in a Table Editor dataset. When an "admin" user opens this dataset, these commands execute with the admin's permissions, potentially exposing sensitive data and modifying lookup files. Exploitation requires phishing the admin user to trigger the commands in their browser. The issue arises because the Table Editor does not apply SPL safeguards to certain searches during the Initial Data step.