Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language (SPL). When another authenticated user selects the action from Event Actions and selects Continue, Splunk Enterprise runs the injected SPL using the permissions of that user. The injected SPL could access or modify data available to that user. The vulnerability is possible because Dashboard Studio does not sufficiently validate workflow-action URLs before submitting requests. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-19T22:17:17.840Z",
  "pubdate": "2026-08-19T22:17:17.840Z",
  "executiveSummary": "A stored Search Processing Language (SPL) injection vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nThe vulnerability allows a user assigned the 'power' Splunk role to store a malicious Dashboard Studio workflow action containing attacker-controlled SPL.\nWhen a victim user interacts with the Event Actions interface and selects Continue, the injected SPL executes within the context of the victim's authenticated session and privileges.\nThe primary impact involves unauthorized access to, or modification of, data accessible by the targeted user.\nExploitation requires user interaction via phishing, where an attacker tricks the victim into initiating the request within their browser, as the 'power' role user cannot trigger the execution independently at will.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation within Dashboard Studio concerning workflow-action URLs before requests are submitted.\nThe vulnerable component is the Dashboard Studio workflow action handling mechanism within the Splunk Enterprise application.\nAffected software versions comprise Splunk Enterprise instances below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAuthentication is required for successful exploitation, specifically necessitating a user account assigned at least the 'power' Splunk role to create and store the malicious workflow action.\nThe attack flow proceeds as follows: First, an authenticated user with the 'power' role crafts and stores a Dashboard Studio workflow action embedded with attacker-controlled SPL strings. Second, the attacker executes a phishing vector to lure an authenticated victim user into selecting the crafted action from Event Actions within the Splunk interface. Third, when the victim selects Continue, the application fails to validate the workflow-action URL and submits the request containing the injected SPL. Finally, Splunk Enterprise executes the injected SPL utilizing the authorization context, permissions, and security scope of the victim user.\nPost-exploitation impact allows the execution of arbitrary SPL commands under the permissions of the targeted user, potentially leading to data exposure, unauthorized data modification, or the abuse of accessible data resources."
}