CVE-2026-76333 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored action from Event Actions and selects Continue, attacker-controlled JavaScript runs in the browser of that user. This could expose data or actions available through Splunk Web to that user. The vulnerability is possible because Dashboard Studio does not sufficiently validate workflow-action URLs before processing them. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The identified vulnerability resides within the Dashboard Studio component of Splunk Enterprise, affecting versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. This security flaw is classified as a Cross-Site Scripting (XSS) vulnerability, specifically falling under the CWE-79 category of Improper Neutralization of Input During Web Page Generation. The root cause lies in insufficient input validation regarding Uniform Resource Locators associated with workflow actions stored by users possessing the power role. When an attacker crafts a malicious URL and stores it as part of a Dashboard Studio workflow action, the system fails to adequately sanitize or validate this input before processing. This lack of rigorous validation allows for the injection of executable JavaScript code into the context of other authenticated users who interact with the compromised dashboard element.
The operational impact of this vulnerability is significant due to its reliance on social engineering tactics rather than direct exploitation through automated means. An attacker must first possess or compromise an account with the power role in Splunk Enterprise, which grants sufficient privileges to create and store workflow actions within dashboards. The actual execution of malicious code occurs when a different authenticated user views the dashboard containing the crafted action and selects Continue from the Event Actions menu. This interaction triggers the browser to execute the attacker-controlled JavaScript payload within the context of the victim's session. Consequently, this enables potential data exfiltration, session hijacking, or unauthorized actions performed under the guise of the affected user, thereby exposing sensitive information available through Splunk Web and compromising the integrity of the platform for that individual.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1059.007, which covers JavaScript execution within web browsers as part of Command and Control or Collection phases. The attack vector is classified as User Interaction (T1204), requiring the victim to actively engage with the malicious content by clicking through the workflow action. This dependency on user interaction mitigates the risk of widespread automated exploitation but does not eliminate the severity for targeted attacks where phishing campaigns are employed against high-value targets within an organization using Splunk Enterprise. The requirement for the attacker to hold a specific role adds a layer of complexity, as it necessitates prior compromise or misconfiguration that grants elevated privileges beyond basic user access.
Mitigation strategies should prioritize immediate upgrading to patched versions of Splunk Enterprise, specifically version 10.4.2 and later, along with all other affected minor releases such as 10.2.6, 10.0.9, and 9.4.14 where patches are available. In environments where patching is not immediately feasible, administrators should enforce strict role-based access control by auditing users assigned the power role to ensure they are trusted entities with strong authentication practices. Additionally, implementing Content Security Policy headers can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts can be executed. Regular security awareness training for all Splunk users is also recommended to reduce the likelihood of falling victim to phishing attempts that exploit this specific workflow action mechanism.