Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to all relevant data available to that user and actions that affect system integrity. The Cross-Site Scripting (XSS) is possible because Splunk Web does not validate the origin and source of messages received by a page message handler. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The unauthenticated user should not be able to exploit the vulnerability at will.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-19T22:17:12.990Z",
  "pubdate": "2026-08-19T22:17:12.990Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13. The vulnerability arises because Splunk Web fails to adequately validate the origin and source of messages received by a page message handler.\nThe primary impact of this flaw includes unauthorized access to all relevant data available to the victim user and the execution of actions that compromise system integrity through arbitrary JavaScript execution within the user's browser context.\nExploitation requires specific conditions: an unauthenticated attacker must successfully phish or trick an authenticated user into visiting a malicious web page and initiating a specific request within their browser. Consequently, the unauthenticated attacker cannot exploit the vulnerability completely at will without user interaction.\nThe risk implication is significant as it bridges an external unauthenticated attacker to the authenticated session of a legitimate Splunk user, potentially leading to data exfiltration or state modification within the affected Splunk Enterprise instance.",
  "technicalDetails": "The root cause of the vulnerability is the improper validation of the origin and source of messages processed by a page message handler within Splunk Web. This design flaw allows arbitrary message ingestion from untrusted sources if a user's browser is navigated to a malicious context.\nThe vulnerable component is Splunk Web, specifically the page message handling functionality that processes incoming inter-frame or cross-document messaging without confirming the cryptographic origin, domain, or authenticity of the sender.\nAffected software versions comprise Splunk Enterprise instances below 10.4.2, 10.2.6, 10.0.9, and 9.4.13. The vulnerability involves web-based network exposure and requires an unauthenticated attacker to leverage social engineering vectors.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts a malicious web page designed to interact with the target Splunk Enterprise instance. 2) The attacker executes a phishing campaign or social engineering attack to trick an authenticated Splunk user into visiting the malicious web page. 3) The malicious page triggers a request or sends a crafted message that is processed by the vulnerable page message handler in Splunk Web. 4) Due to the absence of origin and source validation, Splunk Web accepts and processes the payload. 5) Arbitrary JavaScript code executes in the security context of the victim user's browser.\nThe payload behavior involves executing arbitrary JavaScript in the victim's active session, allowing the attacker to leverage the victim's privileges. Post-exploitation impact encompasses unauthorized data access to all resources and datasets readable by the victim, alongside potential unauthorized actions affecting system integrity within the scope of the user's permissions."
}