CVE-2026-76349

This CVE reveals a design flaw, not merely a coding error. Splunk's URL token substitution feature allowed external URL parameters to flow directly into SPL query execution — a convenience pattern that violated the core principle that untrusted input must never reach execution contexts. The CVSS 6.4 score understates the risk because it treats the 'phishing required' element as a mitigation, but link sharing is fundamental Splunk usage: embedded dashboards, shared searches, documentation links, and 'copy link' buttons all become attack vectors. Every normalized workflow becomes a potential delivery mechanism. The version scatter is the clearest signal of architectural failure. Splunk patched 10.4.x but left 9.4.x, 10.0.x, and 10.2.x vulnerable — which indicates the fix was feature removal or isolation, not sanitization. This matches the historical pattern where URL-to-execution substitution features get deprecated rather than safely preserved. The implication: you cannot backport a security fix; you must upgrade or accept running deprecated code. The deeper risk is ecosystem-wide. Splunk's own documentation explicitly taught this pattern as a dashboard feature. Third-party apps on Splunkbase were built by developers following that guidance. The 10.4.x fix protects core Splunk Enterprise but likely does not protect custom apps using the same token mechanics — unless Splunk isolated the vulnerability at the framework layer, which they have not confirmed. The documentation linking URL parameters to tokens remains unchanged and still appears in search results. Defenders should assume any custom Splunk app accepting URL parameters into tokens is potentially vulnerable until proven otherwise. Audit dashboards and apps for URL-to-token patterns: look for $token$ substitutions where the token value originates from the URL. If you cannot upgrade to 10.4.x+, treat all URL parameter handling in dashboards as untrusted input and implement validation at the application layer. The vulnerability class is likely replicated across the Splunk app ecosystem with no CVE to alert those developers.

Reviewed through automated stages and approved by a human before publication.