EUVD-2026-36080
GHSA-p326-4xf8-xp88
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.<br><br>The vulnerability exists because the URL classifier in classic dashboards only recognizes http:// and https:// schemes when checking for external URLs. Protocol-relative URLs such as //attacker.com bypass this check entirely, and Splunk Web does not show the external-navigation warning dialog to the victim.
AnalysisAI
Classic dashboard drill-down links in Splunk Enterprise and Splunk Cloud Platform can be weaponized by low-privileged authenticated users to silently redirect victims to attacker-controlled external sites, enabling data exfiltration. The flaw stems from an incomplete URL scheme validator that recognizes only 'http://' and 'https://' prefixes, allowing protocol-relative URLs like '//attacker.com' to bypass the external-navigation warning dialog entirely. No public exploit code exists and no active exploitation is confirmed (not in CISA KEV), but the attack requires only a low-privileged account and a single victim click, making it a realistic phishing vector in multi-tenant or large enterprise Splunk deployments.
Technical ContextAI
The root cause is CWE-20 (Improper Input Validation) in the URL classifier embedded within Splunk's classic dashboard rendering engine. Protocol-relative URLs are a well-documented browser behavior where '//attacker.com/path' is resolved using the page's current protocol (typically HTTPS), producing a fully qualified external URL without an explicit scheme. The validator checks for the literal strings 'http://' and 'https://' but performs no normalization or scheme-agnostic parsing, so protocol-relative strings pass the allowlist check unblocked. Consequently, Splunk Web suppresses its external-navigation warning dialog - the sole user-facing safeguard - when the victim clicks an affected drill-down. Affected CPE strings confirm both deployment models: cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:* and cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*. The classic dashboard feature (as distinct from Splunk's newer dashboard framework) is the specific attack surface.
RemediationAI
Upgrade Splunk Enterprise to version 10.2.4, 10.0.7, 9.4.12, or 9.3.13 depending on the active release branch in use - these are the minimum fixed versions confirmed by Splunk advisory SVD-2026-0606 (https://advisory.splunk.com/advisories/SVD-2026-0606). For Splunk Cloud Platform, upgrade to 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132 per the same advisory. Where immediate patching is not feasible, restrict the ability of low-privileged users (those lacking the 'admin' or 'power' Splunk roles) to create or modify classic dashboards with drill-down links, as this removes the primary attack vector; note that this may limit self-service dashboard functionality for those users. Additionally, review existing classic dashboards for drill-down links containing protocol-relative URLs ('//') as an audit measure. Migrating dashboards to the Splunk new dashboard framework, if it is not affected by this issue, could serve as a longer-term architectural workaround, but this trade-off in feature parity should be evaluated against operational requirements.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today