DEV Community

SorrelThorncroft
SorrelThorncroft

Posted on

Detecting Abuse of the SPL2 Module Catalog: CVE-2026-76270

#splunk #cve202676270 #sqlinjection #cwe89

Detecting Abuse of the SPL2 Module Catalog: CVE-2026-76270

Vulnerability overview

CVE-2026-76270 is a SQL injection in the Splunk Enterprise SPL2 module catalog. The vendor advisory SVD-2026-1001 was published on 7 October 2026; NCSC-NL recorded it as NCSC-2026-0412. The CVSS v3.1 base score is 6.5 Medium with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, and the weakness is CWE-89.

Mechanism and exploitation conditions

Splunk Enterprise and Splunk Cloud Platform do not parameterize user-supplied values before using them in database queries for SPL2 module filtering. A user holding a role with the list_spl2_modules capability can inject SQL into that filter and read data available through the affected REST API, including private module definitions belonging to other users.
From a detection standpoint, the activity of interest is a legitimate-looking REST call whose filter parameter carries more structure than a normal module listing would. Because the request authenticates normally and targets a real endpoint, signature-based alerting on the URL alone produces noise. The useful signal is the combination of an authenticated principal with that capability and filter content that does not match routine usage patterns.

Impact

The vendor vector records high confidentiality impact and no integrity or availability impact, so the expected artefact is disclosure of module definitions rather than tampering or outage. Module content can include saved SPL2 code, index and field references, and naming that describes internal architecture. Detection therefore aims to establish whether a capability-bearing account read beyond the definitions it owns.

Affected products and scope

Splunk Enterprise 10.4.0 to 10.4.2 is affected and 10.4.3 contains the fix. Splunk states that 10.2.x, 10.0.x and 9.4.x are not affected. Splunk Cloud Platform shares the root cause and receives the update through the service.

Exposure context

The ZoomEye Search Dork app="Splunk Enterprise" returned 114,239 instances when this article was prepared, which describes observable deployments rather than confirmed vulnerable hosts. The companion query vul.cve="CVE-2026-76270" returned 0, which is typical immediately after an advisory goes public.

Remediation and mitigations

Upgrade to Splunk Enterprise 10.4.3 or later, which the batch advisory lists alongside 10.2.7, 10.0.10 and 9.4.15 as fixed versions. Additional configuration steps apply to CVE-2026-76264, CVE-2026-76265, CVE-2026-76272 and CVE-2026-76280 only, so this identifier is closed by the version change.
For monitoring, restrict list_spl2_modules to accounts that require it and review the REST access records of those accounts for filter values that extend beyond routine listing syntax. Where module ownership boundaries exist between teams, treat cross-boundary reads as the event worth investigating. Detection here is about who read what, not about a distinctive exploit payload.

References

Top comments (0)