CVE-2026-76334
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A user with the "power" role in Splunk Enterprise can store a Dashboard Studio workflow action containing attacker-controlled SPL. When another authenticated user selects the action, Splunk runs the injected SPL with that user's permissions, potentially allowing access or modification of data. The vulnerability is due to insufficient validation of workflow-action URLs in Dashboard Studio.
Risk Assessment
An attacker could exploit this to gain unauthorized access or modify data within the victim's permissions, potentially compromising data confidentiality and integrity.
Recommendation
Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later to remediate the vulnerability.
Original NVD description (English source)
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language (SPL). When another authenticated user selects the action from Event Actions and selects Continue, Splunk Enterprise runs the injected SPL using the permissions of that user. The injected SPL could access or modify data available to that user. The vulnerability is possible because Dashboard Studio does not sufficiently validate workflow-action URLs before submitting requests. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will.