Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds the "admin" Splunk role, the script could access all relevant data available through Splunk Web and perform actions with that user's permissions. The vulnerability is possible because Splunk Web does not limit the permitted dashboard visualization options to safe presentation settings and does not escape tooltip values before rendering them. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T22:17:19.427Z",
  "pubdate": "2026-08-19T22:17:19.427Z",
  "executiveSummary": "Splunk Enterprise contains a stored cross-site scripting (XSS) vulnerability residing within dashboard sparkline format options. The flaw permits a user assigned the \"power\" Splunk role to store a malicious script inside dashboard configurations. When another user views the compromised dashboard, the unauthorized JavaScript executes within their browser session. If the victim holds the \"admin\" Splunk role, the injected script gains access to all relevant data available through Splunk Web and can execute actions utilizing the administrator's high-privilege permissions. The vulnerability stems from a failure in Splunk Web to restrict permitted dashboard visualization options to safe presentation settings and an absence of proper output encoding for tooltip values prior to rendering. Exploitation mandates a phishing prerequisite where the attacker tricks the targeted user into initiating a request within their browser, as the \"power\" role user cannot independently trigger the execution at will. Affected software spans Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The risk implications are severe due to potential privilege escalation from \"power\" to \"admin\" via social engineering, leading to complete compromise of sensitive operational data and administrative capabilities exposed through the web interface.",
  "technicalDetails": "The vulnerability is a stored cross-site scripting (XSS) flaw located in Splunk Enterprise dashboard sparkline format options. The root cause originates from insufficient input validation and output sanitization within Splunk Web. Specifically, the application fails to restrict permitted dashboard visualization options exclusively to safe presentation settings and omits necessary context-aware output encoding (escaping) for tooltip values before rendering them in the Document Object Model (DOM).\nThe affected component is Splunk Web, specifically the visualization rendering engine responsible for processing dashboard sparkline format options and tooltip attributes. The vulnerability affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.\nAuthentication and privilege requirements dictate that the attacker must possess the \"power\" Splunk role to initially create or modify the malicious dashboard sparkline configuration and store the payload. However, the attacker cannot execute the payload at will. Exploitation requires a multi-step attack flow involving social engineering. First, the attacker with the \"power\" role crafts a malicious script payload embedded within the dashboard sparkline format options. Second, the attacker must phish an administrative user by tricking them into initiating a request that loads the compromised dashboard within their browser. Third, when the victim views the dashboard, Splunk Web renders the unescaped tooltip values containing the stored script. Finally, the browser executes the malicious JavaScript within the security context of the victim's active session.\nThe payload behavior depends on the privileges of the victim viewing the dashboard. If the victim holds the \"admin\" Splunk role, the executing JavaScript inherits full administrative privileges. The script can access all relevant data available through Splunk Web, perform unauthorized administrative actions, and manipulate the application on behalf of the victim. Network exposure is constrained to the Splunk Web interface."
}