Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all relevant data and system integrity available to that user. The vulnerability is possible because the dashboard table renderer does not sufficiently restrict tooltip options or escape tooltip content before display.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-19T22:17:16.777Z",
  "pubdate": "2026-08-19T22:17:16.777Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. This security flaw enables a low-privileged user lacking 'admin' or 'power' roles to store a malicious dashboard view containing arbitrary JavaScript payloads. When an unsuspecting victim opens the crafted dashboard and hovers the cursor over a sparkline table cell, the embedded script executes within the context of the victim's browser session. This exploitation vector allows an attacker to compromise system integrity and access all relevant data, administrative functionalities, and backend resources available to the targeted user. The attack requires user interaction via mouse hovering and relies on the victim accessing the compromised dashboard view. The business risk is significant as it facilitates unauthorized data access, session hijacking, and potential privilege escalation depending on the access level of the user who triggers the payload.",
  "technicalDetails": "The root cause of this vulnerability lies within the dashboard table renderer component of Splunk Enterprise. Specifically, the rendering engine fails to sufficiently restrict tooltip configuration options and neglects to properly sanitize or escape tooltip content before rendering it in the Document Object Model (DOM).\nAuthentication and privilege requirements are minimal for the initial vector; a standard, unprivileged user who possesses permissions to create and save dashboard views can craft the malicious payload. The attack does not require administrative or power user privileges to construct and store the malicious dashboard.\nThe exploitation method follows a precise attack flow. First, an authenticated attacker creates or modifies a dashboard view, injecting malicious JavaScript into parameters associated with a sparkline table cell tooltip. Second, the attacker saves the dashboard, resulting in the malicious payload being stored persistently within the Splunk application storage backend. Third, a victim user opens the compromised dashboard view. Finally, when the victim hovers their mouse cursor over the targeted sparkline table cell, the unescaped JavaScript payload is dynamically evaluated and executed within the victim's browser session.\nBecause the payload executes in the security context of the victim, the payload behavior inherits the user's session cookies, API tokens, and session privileges. The post-exploitation impact includes unauthorized data exfiltration, the capability to perform state-changing actions on behalf of the victim, and potential interaction with internal APIs accessible to the authenticated session. The vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14."
}