CVE-2026-76267 json
Log Injection through the REST API in Splunk App for Splunk O11y Cloud
published 2026-10-07 32 d ago modified 2026-10-14 25 d ago also EUVD-2026-94619
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log.
Splunk Enterprise versions 9.4.x are not affected.
Patch / fix
- Splunk Splunk Enterprise 10.0.10, 10.2.7, 10.4.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 31 d ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected products
- Splunk Splunk Enterprise
Classification
- Weakness
-
- CWE-117 Improper Output Neutralization for Logs
References
-
advisory.splunk.com
/advisories/SVD-2026-1001
vendor-advisory, mitigation
Sources
- CVE List CVE-2026-76267
- NVD CVE-2026-76267
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.