splunk_advisories
- Source-provided label
- Not reported
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Jul 15, 2026 00:00 UTC
- Retrieved
- Oct 08, 2026 03:55 UTC
SVD-2026-0702: SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the list_deployment_server capability into running arbitrary Search Processing Language (SPL) searches on their behalf as splunk-system-user, allowing for access
Reference details
- Source category
- Vendor advisories
- Report title
SVD-2026-0702: SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise- First reported
- Jul 15, 2026 00:00 UTC
- Last reported
- Jul 15, 2026 00:00 UTC
- Catalog updated
- Oct 08, 2026 03:55 UTC
- Record ID
9bea570ab57316e2950e755ca9f78dd66d0b4534dbc37a73beb392a0481ab01e
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.