CVE-2026-76326: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the dashboard table renderer fails to properly neutralize user-controllable input in tooltip content. This allows a user with limited privileges (not admin or power roles) to inject JavaScript that executes in the browser of another user viewing the dashboard. The vulnerability arises from insufficient escaping or restriction of tooltip options, enabling cross-site scripting (XSS) that can access data and system integrity available to the victim user.

An attacker with limited Splunk roles can inject JavaScript into dashboard tooltips that executes in other users' browsers, potentially exposing sensitive data accessible to those users. The vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS score is 5.7 (medium severity), reflecting network attack vector, low attack complexity, and required user interaction.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigations are specified in the provided data.