EUVD-2026-36085
GHSA-73fj-f5qc-x4jf
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Network-accessible dashboard feature exploited by authenticated low-privilege user; victim interaction mandatory; only browser-side confidentiality impacted with no integrity or availability effect.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a classic dashboard that exfiltrates sensitive data from the browser of a higher-privileged user who views it.
The exfiltration is possible because classic dashboard panels do not fully validate style attribute values, which can allow for requests to reach external domains outside the configured Trusted Domains List.
The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.
AnalysisAI
Classic dashboard style attribute injection in Splunk Enterprise and Splunk Cloud Platform enables a low-privileged authenticated user to craft panels that bypass the Trusted Domains List and exfiltrate sensitive data from a higher-privileged user's browser session. Affected branches span Splunk Enterprise below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and multiple Splunk Cloud Platform release trains. No public exploit has been identified at time of analysis, and SSVC rates current exploitation as none with partial technical impact, though the high confidentiality impact potential warrants prompt patching in environments where low-privileged users can share dashboards with administrators.
Technical ContextAI
The root cause is CWE-20 (Improper Input Validation) within Splunk's classic dashboard rendering engine. Specifically, classic dashboard panel definitions accept CSS style attribute values that are not fully sanitized before being rendered in a viewer's browser. This allows injection of CSS constructs - such as background-image or similar properties - that reference arbitrary external URLs, effectively circumventing the Trusted Domains List enforcement intended to restrict outbound browser requests. When a higher-privileged user loads the malicious dashboard, their browser issues HTTP requests to attacker-controlled infrastructure, potentially leaking HTTP headers including session tokens. CPE strings cpe:2.3:a:splunk:splunk_enterprise and cpe:2.3:a:splunk:splunk_cloud_platform confirm both the self-hosted and managed SaaS products are affected across multiple release branches. This is a well-understood class of CSS-based data exfiltration, distinct from traditional reflected or stored XSS in that it operates via style injection rather than script execution.
RemediationAI
Upgrade Splunk Enterprise to version 10.2.4, 10.0.7, 9.4.12, or 9.3.13 (or later within the respective branch) as confirmed by the vendor advisory SVD-2026-0607 at https://advisory.splunk.com/advisories/SVD-2026-0607. Splunk Cloud Platform customers should verify their instance has been updated to 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132 depending on their deployed release train; Splunk Cloud Platform updates are typically managed by Splunk and may already be applied. As a compensating control prior to patching, restrict classic dashboard creation and sharing permissions to trusted users only by reviewing role-based access controls - note this may impact legitimate analyst workflows. Additionally, audit existing classic dashboards for unexpected external domain references in style attributes, and ensure the Trusted Domains List is configured as restrictively as operationally possible to limit the blast radius of any bypass. Blocking outbound HTTP/HTTPS traffic from Splunk web servers to non-approved external domains at the network perimeter can further reduce exfiltration risk but may disrupt legitimate integrations.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today