Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs in the browser of that user and could access all data available to that user. The vulnerability is possible because Splunk Web uses the alert threshold value in generated alert trigger condition markup without escaping special characters. Successful exploitation requires another user to open the crafted link. For more information see Configure alert trigger conditions (https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/10.4/manage-alert-trigger-conditions-and-throttling/configure-alert-trigger-conditions) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-19T22:17:15.750Z",
  "pubdate": "2026-08-19T22:17:15.750Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe vulnerability allows an authenticated user assigned a role with the schedule_search capability to inject malicious scripts into the alert trigger condition field via Splunk Web.\nWhen another user interacts with the crafted link or alert configuration interface, the injected script executes within the context of the victim's browser session.\nSuccessful exploitation enables the execution of arbitrary JavaScript, potentially granting the attacker access to all data and capabilities available to the victim within the application.\nThe attack requires an attacker to possess specific role-based capabilities to create or modify alert triggers and relies on social engineering or user interaction, where a victim must open a crafted link or view the compromised component.",
  "technicalDetails": "The vulnerability stems from improper input sanitization and output encoding within Splunk Web components responsible for handling alert configurations.\nSpecifically, Splunk Web incorporates the alert threshold value directly into the generated alert trigger condition markup without performing adequate escaping of special characters.\nAn authenticated user possessing a role with the schedule_search capability can supply a malicious payload containing executable script content into the alert trigger condition field during the creation or modification of an alert.\nThis payload is persistently stored within the application backend data structures.\nThe attack flow proceeds as follows: First, the privileged user stores the malicious script inside the alert threshold field. Second, the attacker distributes a crafted link referencing the affected interface to a target user. Third, when the victim accesses the crafted link, Splunk Web dynamically renders the alert trigger condition markup, including the unescaped malicious script. Finally, the script executes inside the victim's browser session, inheriting their session cookies and authorization privileges.\nThe vulnerable component is the Splunk Web interface handling alert trigger condition markup generation.\nAffected software versions include Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAuthentication is required to interact with Splunk Web and configure alerts, and privilege requirements dictate that the attacker must hold a role endowed with the schedule_search capability.\nThe post-exploitation impact includes unauthorized access to sensitive data accessible to the victim, session hijacking, and potential execution of administrative actions depending on the victim's privilege level."
}