CVE-2026-76346 in Splunk
Summary
by MITRE • 08/20/2026
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds the "admin" Splunk role, the script could access all relevant data available through Splunk Web and perform actions with that user's permissions. The vulnerability is possible because Splunk Web does not limit the permitted dashboard visualization options to safe presentation settings and does not escape tooltip values before rendering them. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The identified vulnerability represents a significant cross-site scripting flaw within Splunk Enterprise, affecting versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. This security issue stems from an insufficient input validation and output encoding mechanism in the Splunk Web interface, specifically regarding how dashboard visualization options are processed. The core technical flaw lies in the application's failure to properly escape tooltip values before rendering them in the browser context. By not sanitizing these inputs, the system allows malicious scripts embedded within specific configuration fields to be executed as part of the page content rather than being treated as inert data strings. This lack of proper encoding creates a direct pathway for client-side code injection when certain dashboard elements are rendered.
The attack vector specifically targets the sparkline format options available in dashboards. A user possessing the power role, which typically grants elevated privileges over dashboard creation and modification but not full administrative control, can craft a malicious payload by embedding JavaScript within these specific visualization settings. The vulnerability is classified under CWE-79, known as Improper Neutralization of Input During Web Page Generation Cross-site Scripting, because it involves the injection of executable scripts into web pages viewed by other users. Furthermore, this behavior aligns with ATT&CK technique T1059.007, JavaScript Execution, where an adversary uses scripting languages to perform actions within a victim's browser environment without triggering traditional command-line execution alerts.
The operational impact of this vulnerability is severe due to the potential for privilege escalation through social engineering or phishing tactics. The exploitation requires that another user with higher privileges, specifically those holding the admin role, views the compromised dashboard in their web browser. When an administrator loads such a maliciously crafted dashboard, the unescaped tooltip values trigger the execution of the embedded JavaScript within the context of the Splunk Web application and the administrator's active session. Consequently, the injected script gains access to all data accessible through Splunk Web under that admin account. This allows the attacker to exfiltrate sensitive information, manipulate configurations, or perform actions with full administrative permissions, effectively bypassing the intended role-based access controls designed to separate power users from administrators.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is upgrading Splunk Enterprise to version 10.4.2 or later, where these input validation and output encoding issues have been addressed by the vendor. In environments where patching is not immediately feasible, organizations should enforce strict role-based access control policies as outlined in official documentation regarding user security management. It is critical to restrict the ability of power users to create or modify dashboards that will be viewed by administrators until patches are applied. Additionally, implementing a Web Application Firewall with rules capable of detecting and blocking cross-site scripting payloads can provide an additional layer of defense against exploitation attempts targeting this specific vector in unpatched systems.