CVE-2026-76326 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all relevant data and system integrity available to that user. The vulnerability is possible because the dashboard table renderer does not sufficiently restrict tooltip options or escape tooltip content before display.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The identified vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14 represents a critical cross-site scripting flaw that undermines the platform's role-based access control mechanisms. This security defect allows users with limited privileges who lack admin or power roles to execute arbitrary JavaScript code within the browser context of other authenticated users. The attack vector relies on social engineering combined with specific UI interactions, where an attacker crafts and stores a malicious dashboard view containing embedded script payloads. When a victim user opens this compromised dashboard and performs a hover action over a sparkline table cell, the application's rendering engine triggers the execution of the stored JavaScript without proper sanitization or validation checks.
The technical root cause lies in the insufficient input validation and output encoding performed by the dashboard table renderer component. Specifically, the system fails to restrict tooltip configuration options or escape special characters within tooltip content before it is rendered in the browser DOM. This lack of strict context-aware escaping allows malicious script fragments to bypass security filters that would typically neutralize such inputs. By leveraging this flaw, an attacker can inject code that executes with the same privileges as the victim user, effectively elevating their own access level through the compromised session rather than exploiting a direct privilege escalation in the backend database or authentication service.
The operational impact of this vulnerability is severe due to its potential for data exfiltration and system integrity compromise. Since the injected JavaScript runs within the context of the target user's active session, it can access all sensitive information available to that role, including proprietary business intelligence, customer records, and internal network configurations. Furthermore, an attacker could manipulate the application state by modifying DOM elements or issuing authenticated API requests on behalf of the victim, leading to unauthorized data modifications or deletions. This capability effectively bypasses Splunk's intended security boundaries, turning a low-privileged account into a potent tool for lateral movement within the organization's monitoring infrastructure.
From an industry standard perspective, this vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as cross-site scripting. The attack methodology corresponds to ATT&CK technique T1059, specifically sub-technique 007 for command and script interpretation via JavaScript, often categorized under Initial Access or Execution depending on the subsequent actions taken by the attacker. To mitigate this risk, organizations must immediately upgrade Splunk Enterprise to version 10.4.2 or later, where these rendering flaws have been addressed through enhanced input sanitization protocols. Additionally, implementing strict Content Security Policy headers can provide a layer of defense-in-depth by restricting script execution sources, although upgrading the software remains the primary and most effective remediation strategy for this specific implementation flaw.