EUVD-2026-36081
GHSA-c58f-cc4q-2mvj
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious classic dashboard that exfiltrates sensitive data to an external server when a higher-privileged user views it, bypassing the external content restriction through a Cascading Style Sheets (CSS) injection.<br><br>The Trusted Domains security check does not fully validate inline style attribute values, which can allow for outbound requests to untrusted domains and credential exfiltration when a victim views a crafted dashboard.
AnalysisAI
CSS injection in Splunk Enterprise and Splunk Cloud Platform classic dashboards enables credential and sensitive data exfiltration by low-privileged users targeting higher-privileged accounts. A low-privileged user (without 'admin' or 'power' roles) can craft a malicious classic dashboard containing injected CSS via inline style attributes; when a higher-privileged user views the dashboard, outbound HTTP requests are triggered to attacker-controlled external servers, bypassing the Trusted Domains restriction. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the C:H confidentiality impact and cross-privilege exploitation path make this a meaningful insider or compromised-account threat in environments with mixed privilege levels.
Technical ContextAI
The vulnerability resides in Splunk's classic dashboard rendering engine, where inline CSS style attribute values are not fully validated by the Trusted Domains security control - a feature intended to restrict outbound connections to approved domains. The root cause is CWE-20 (Improper Input Validation): the Trusted Domains check inadequately sanitizes inline style attribute values, allowing an attacker to embed CSS directives (such as background-image or @import using url()) that cause the victim's browser to issue GET requests to arbitrary external hosts. Because CSS is processed client-side by the victim's browser during dashboard rendering, the exfiltration occurs within the victim's authenticated session context, potentially leaking session tokens, credentials, or other sensitive HTTP headers to the attacker's server. Affected products are identified by CPE strings cpe:2.3:a:splunk:splunk_enterprise and cpe:2.3:a:splunk:splunk_cloud_platform. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) confirms this is a network-exploitable, stored cross-user attack with high confidentiality impact but no integrity or availability consequence.
RemediationAI
The primary remediation is to upgrade to a patched release. For Splunk Enterprise, upgrade to version 10.2.4, 10.0.7, 9.4.12, or 9.3.13 depending on the active major branch. For Splunk Cloud Platform, upgrade to 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132 respectively; Splunk Cloud customers should verify with Splunk support whether their instance has been automatically updated. The full vendor advisory and patching guidance is available at https://advisory.splunk.com/advisories/SVD-2026-0604. If immediate patching is not possible, compensating controls include restricting classic dashboard creation permissions to trusted users only, auditing existing dashboards for unexpected inline style attributes, enforcing strict Trusted Domains allowlists to limit the blast radius of any outbound CSS-triggered requests, and monitoring outbound HTTP traffic from Splunk UI components for anomalous connections to external hosts. Note that restricting dashboard creation may impact legitimate business workflows in teams that rely on self-service analytics.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today