Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and cause arbitrary JavaScript to run in the browser of another user when that user opens a crafted tour link. The JavaScript runs in the browser of the affected user, allowing for access to all relevant data available to that user. The Cross-Site Scripting (XSS) vulnerability is possible because Splunk Web renders tour content and tour navigation links without sufficient output encoding and accepts a tour selector value that can be treated as markup. The vulnerability requires another user to open a crafted tour link. The user who holds the "power" Splunk role should not be able to trigger JavaScript execution in another user's browser without that user interaction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-19T22:17:16.527Z",
  "pubdate": "2026-08-19T22:17:16.527Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe vulnerability allows an authenticated user with the power Splunk role to create a malicious Splunk Web tour containing arbitrary JavaScript.\nWhen another user opens a crafted tour link, the injected script executes within the context of the victim's browser session.\nThe impact of successful exploitation includes unauthorized access to all relevant data and functionalities accessible to the affected user.\nThe vulnerability requires user interaction, specifically the victim opening a malicious tour link provided by the attacker.\nThe risk stems from insufficient output encoding of tour content and navigation links, alongside the acceptance of tour selector values that can be parsed and executed as markup by Splunk Web.",
  "technicalDetails": "The root cause of the vulnerability is insufficient output encoding and improper sanitization of tour content, navigation links, and tour selector values within Splunk Web.\nThe vulnerable component is the Splunk Web tour rendering engine, which fails to neutralize markup passed via tour selectors and tour definitions.\nAuthentication and privilege requirements dictate that an attacker must possess the power Splunk role to create and configure the malicious Splunk Web tour.\nExploitation requires secondary user interaction, wherein a victim user must be induced to open a crafted tour link generated by the attacker.\nThe attack flow proceeds as follows: First, the attacker authenticates with a power role and creates a specially crafted Splunk Web tour containing malicious JavaScript payloads within the tour selector or tour content fields. Second, the attacker distributes the crafted tour link to the target user. Third, when the victim accesses the crafted tour link, Splunk Web renders the tour content and navigation components without proper output encoding. Finally, the browser parses the unescaped payload as markup, executing the arbitrary JavaScript within the victim's active session.\nThe payload behavior involves executing arbitrary JavaScript in the browser of the affected user, which inherits the session permissions and security context of the victim.\nPost-exploitation impact includes the potential unauthorized access to sensitive data, session compromise, and the execution of actions within the application on behalf of the victim user.\nAffected versions comprise Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14."
}