CVE-2026-76267

Log Injection through the REST API in Splunk App for Splunk O11y Cloud

State: Published
Severity: 4.3 Medium
Published: Oct 7, 2026
Updated: Oct 8, 2026
Reserved: Aug 19, 2026

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log.

Splunk Enterprise versions 9.4.x are not affected.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	cisco

Weaknesses

CWE-117 The software does not neutralize or incorrectly neutralizes output that is written to logs.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	10.4 to before 10.4.3Affected 10.2 to before 10.2.7Affected 10.0 to before 10.0.10Affected

References

https://advisory.splunk.com/advisories/SVD-2026-1001

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.