CVE-2026-76267

Received Received - Intake

Splunk Enterprise REST API Log Injection via SignalFlow

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log. Splunk Enterprise versions 9.4.x are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-76267

Affected Vendors & Products

Vendor	Product	Version / Range
Splunk	Splunk	Enterprise 10.4
Splunk	Splunk	Enterprise 10.2
Splunk	Splunk	Enterprise 10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-117	The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10. A user with a role that has the read_o11y_content capability can inject forged entries into the app log via the REST API. This happens because Splunk App for Splunk O11y Cloud does not properly neutralize user-supplied SignalFlow content before writing it to the app log.

Detection Guidance

Detection involves checking Splunk Enterprise versions for affected releases (below 10.4.3, 10.2.7, or 10.0.10) and reviewing app logs for forged entries injected via the REST API. Monitor logs for unusual SignalFlow content in the Splunk App for Splunk O11y Cloud logs.

Impact Analysis

An attacker with the right permissions could manipulate logs, potentially leading to false information being recorded. This could affect monitoring, auditing, or troubleshooting processes in Splunk Enterprise environments.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized data manipulation through forged log entries. If exploited, it may compromise the integrity of audit logs, which are critical for demonstrating compliance with these regulations.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.3, 10.2.7, or 10.0.10 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-76267. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70