CVE-2026-76333: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. in Splunk Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the Dashboard Studio component improperly neutralizes user-controllable input in workflow-action URLs. A user holding the "power" role can store a malicious URL that, when selected by another authenticated user, executes arbitrary JavaScript in their browser. This cross-site scripting vulnerability requires the victim to interact with the malicious action, typically via phishing. The flaw is due to insufficient validation of URLs before processing in Dashboard Studio, potentially exposing data or enabling unauthorized actions through Splunk Web.

Successful exploitation allows attacker-controlled JavaScript to run in the browser of an authenticated Splunk Web user, potentially exposing sensitive data or enabling unauthorized actions. The attacker must have the "power" role to store the malicious URL and must trick another user into triggering the action. The vulnerability has a high severity with CVSS 3.1 score of 7.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and user interaction.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, restrict the assignment of the "power" role to trusted users only and educate users to avoid interacting with suspicious workflow actions. Review Splunk's official documentation on role capabilities for guidance.