Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored action from Event Actions and selects Continue, attacker-controlled JavaScript runs in the browser of that user. This could expose data or actions available through Splunk Web to that user. The vulnerability is possible because Dashboard Studio does not sufficiently validate workflow-action URLs before processing them. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T22:17:17.673Z",
  "pubdate": "2026-08-19T22:17:17.673Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) security flaw affecting Splunk Enterprise.\nThe vulnerability allows an authenticated user holding the 'power' Splunk role to store a malicious Dashboard Studio workflow action configured with a crafted Uniform Resource Locator (URL) containing arbitrary JavaScript.\nWhen an unsuspecting victim selects the stored action from Event Actions and clicks Continue, the attacker-controlled JavaScript executes within the browser context of the affected user.\nThis unauthorized script execution can expose sensitive data, session tokens, or perform actions available through Splunk Web on behalf of the victim.\nAffected products include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nExploitation requires specific prerequisites, including the attacker holding a 'power' role to create the crafted workflow action and successfully phishing the victim by tricking them into initiating the request within their browser.\nThe vulnerability carries significant risk implications as it bridges lower-privileged workflow creation capabilities with arbitrary script execution in the context of higher-privileged users interacting with Splunk Web.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation within Dashboard Studio regarding workflow-action URLs before processing them.\nThe vulnerable component is Splunk Enterprise Dashboard Studio, specifically its handling and processing of workflow-action Uniform Resource Locators.\nAffected versions comprise Splunk Enterprise instances below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAuthentication and privilege requirements dictate that the attacker must possess the 'power' Splunk role to initially store the crafted Dashboard Studio workflow action.\nHowever, the vulnerability description notes that a user holding the 'power' Splunk role should not be able to exploit the vulnerability at will, as it necessitates social engineering.\nThe attack flow proceeds as follows: First, an authenticated user with the 'power' role creates and stores a Dashboard Studio workflow action containing a crafted Uniform Resource Locator embedded with malicious JavaScript payload behavior.\nSecond, the attacker deploys a phishing vector to trick another authenticated user into selecting the stored action from Event Actions within Splunk Web.\nThird, when the victim selects Continue, the application processes the insufficiently validated URL.\nFinally, the attacker-controlled JavaScript executes natively within the browser of the affected user.\nThe post-exploitation impact includes the potential exposure of sensitive data, unauthorized access to internal resources, or the execution of unauthorized actions available through Splunk Web that the victim's session possesses permissions to perform."
}