CVE-2026-76328: The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. in Splunk Splunk Enterprise

In affected Splunk Enterprise versions, a user with the "power" role can inject attacker-controlled SPL into dashboards. When another authenticated user exports the dashboard to PDF, the SPL executes with that user's permissions due to inadequate validation of dashboard content by Splunk Web. This can lead to unauthorized data access or modification. Exploitation requires social engineering to induce the victim to export the dashboard. The vulnerability is fixed in versions 10.4.1, 10.2.6, 10.0.9, and 9.4.14.

An attacker with the "power" role can embed malicious SPL in dashboards that execute under the permissions of other authenticated users during PDF export. This can result in unauthorized access or modification of data accessible to the victim user. The attack requires user interaction via phishing to trigger the export. The vulnerability does not allow the attacker to exploit it at will without victim interaction.

Upgrade Splunk Enterprise to version 10.4.1, 10.2.6, 10.0.9, or 9.4.14 or later, where this vulnerability is fixed. Until patched, restrict the "power" role to trusted users only and educate users to avoid phishing attempts that could trigger malicious dashboard exports. No other vendor advisory mitigation is provided.