EUVD-2026-36083
GHSA-hw35-mvfj-v86g
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious classic dashboard that exfiltrates sensitive data to an external server.
The vulnerability exists because URL validation on the external content dialog is incomplete, which can allow for requests to untrusted domains when a user interacts with a crafted dashboard.
AnalysisAI
Classic dashboard URL validation bypass in Splunk Enterprise and Splunk Cloud Platform enables low-privileged authenticated users to craft dashboards that silently exfiltrate sensitive data to attacker-controlled external servers. The flaw (CWE-20) resides in the external content dialog, which fails to enforce complete domain restrictions, allowing outbound requests to untrusted hosts when a victim interacts with the malicious dashboard. No public exploit exists and this vulnerability is not listed in CISA KEV, but the High confidentiality impact (C:H) in the CVSS vector reflects meaningful data exposure risk in environments where Splunk indexes security events, credentials, or sensitive operational logs.
Technical ContextAI
The affected component is Splunk's classic dashboard framework, which supports embedding external content via a dedicated external content dialog. The root cause is CWE-20 (Improper Input Validation) - specifically, incomplete URL validation that fails to enforce an adequate allowlist or sufficiently restrict requests to untrusted external domains. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) confirms that exploitation occurs over the network with low attack complexity, requiring only a low-privileged Splunk session and victim user interaction. CPE strings cpe:2.3:a:splunk:splunk_enterprise and cpe:2.3:a:splunk:splunk_cloud_platform confirm that both on-premises and SaaS deployment models across multiple major release trains are affected. The unchanged scope (S:U) indicates the vulnerability does not cross a privilege boundary beyond the Splunk application itself.
RemediationAI
The primary fix is to upgrade Splunk Enterprise to versions 10.2.4, 10.0.7, 9.4.12, or 9.3.13 depending on the installed release branch, and Splunk Cloud Platform to 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132 respectively, per vendor advisory SVD-2026-0605 at https://advisory.splunk.com/advisories/SVD-2026-0605. Where immediate patching is not feasible, a targeted compensating control is to restrict classic dashboard creation and sharing rights for low-privileged users who do not hold the 'admin' or 'power' Splunk roles - note this trade-off may limit self-service reporting workflows and requires careful role auditing. Additionally, implementing network egress filtering on Splunk infrastructure to block unexpected outbound connections to non-approved domains can reduce exfiltration impact if exploitation occurs, though it does not remediate the underlying URL validation flaw and may interfere with legitimate external data integrations.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today