Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser of another authenticated user who visits a standard Splunk Web page. The JavaScript could expose all relevant data and affect system integrity within the second user permissions. The Cross-Site Scripting (XSS) vulnerability is possible because Splunk Web resolves auto-tour entries from the app namespace and uses untrusted tour content when building the tour image.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T22:17:16.650Z",
  "pubdate": "2026-08-19T22:17:16.650Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe vulnerability allows an authenticated user with the power Splunk role to store a malicious ui-tour knowledge object configured to match an auto-tour page name and share it at the app level.\nWhen another authenticated user visits a standard Splunk Web page, the malicious object executes arbitrary JavaScript within their browser session.\nThe impact of successful exploitation includes the exposure of all relevant data accessible to the victim and potential compromise of system integrity within the bounds of the second user's permissions.\nAttackers require the power role to create and share the malicious knowledge object within the application namespace.\nThe risk implications are significant as it enables stored script execution against higher-privileged or standard users interacting with shared application content in Splunk Web.",
  "technicalDetails": "The root cause of the vulnerability resides in the way Splunk Web resolves auto-tour entries from the app namespace and utilizes untrusted tour content when constructing the tour image.\nThe vulnerable component is the ui-tour knowledge object handling within Splunk Web.\nAffected versions comprise Splunk Enterprise instances below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAuthentication requirements dictate that the attacker must be authenticated and possess the power role within Splunk Enterprise.\nPrivilege requirements involve the ability to create and share knowledge objects at the app level using the power role.\nNetwork exposure is scoped to Splunk Web accessible interfaces.\nThe exploitation method begins when a user with the power role creates a malicious ui-tour knowledge object that specifically matches an auto-tour page name.\nThe attacker shares this crafted object at the app level.\nThe attack flow proceeds when a second authenticated user visits a standard Splunk Web page.\nDuring this visit, Splunk Web resolves the auto-tour entries from the app namespace and processes the untrusted tour content during tour image building without proper sanitization or validation.\nPayload behavior involves the execution of arbitrary JavaScript inside the victim's browser session.\nPost-exploitation impact includes the ability of the injected JavaScript to expose all relevant data accessible by the victim and affect system integrity constrained strictly by the second user's permission set."
}