Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language (SPL) for another authenticated user. The attacker-controlled SPL could access all relevant data and affect system integrity and availability. The vulnerability is possible because Dashboard Studio does not consistently enforce the expected app-visibility authorization boundary before dashboard search query options reach search dispatch. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "user" Splunk role should not be able to exploit the vulnerability at will. For more information see Create search-based visualizations with ds.search (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/dashboard-studio/10.4/use-data-sources/create-search-based-visualizations-with-ds.search) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-19T22:17:16.267Z",
  "pubdate": "2026-08-19T22:17:16.267Z",
  "executiveSummary": "Splunk Enterprise contains an authorization bypass vulnerability within Dashboard Studio affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises from inconsistent enforcement of app-visibility authorization boundaries before dashboard search query options reach search dispatch.\nA low-privileged user assigned the 'user' Splunk role can craft a specialized Dashboard Studio dashboard configured to execute arbitrary, attacker-controlled Search Processing Language (SPL). While the low-privileged attacker cannot exploit this vulnerability directly at will, the attack flow requires a social engineering component, specifically tricking another authenticated user via phishing into initiating a request within their browser.\nUpon successful exploitation, the crafted SPL executes in the context of the targeted authenticated user. This allows the attacker-controlled query to access all data accessible to the victim and compromise system integrity and availability.",
  "technicalDetails": "The root cause of the vulnerability resides in Dashboard Studio's search query handling mechanism. Specifically, the component fails to consistently validate and enforce expected app-visibility authorization boundaries prior to passing dashboard search query options to the search dispatch subsystem.\nThe vulnerable component is Dashboard Studio, particularly the handling of search-based visualizations utilizing ds.search data sources. Affected product versions include Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe exploitation method requires an authenticated user assigned the standard 'user' Splunk role to create a malicious Dashboard Studio dashboard containing crafted SPL. Because the low-privileged user cannot independently trigger the payload at will, the attack flow relies on a phishing prerequisite. The attacker must trick a target authenticated user into initiating a request inside their browser, effectively leveraging the victim's session and security context.\nOnce the victim interacts with the malicious dashboard context in their browser, the unvalidated search query options bypass app-visibility authorization checks and reach search dispatch. The payload executes with the privileges and permissions of the victimized authenticated user, granting access to all relevant data repositories accessible to that user.\nThe post-exploitation impact includes unauthorized data access across accessible indexes, potential exposure of sensitive organizational information, and degradation of system integrity and availability resulting from arbitrary SPL execution."
}