CVE-2026-76334: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. in Splunk Splunk Enterprise

This vulnerability in Splunk Enterprise occurs because Dashboard Studio does not properly validate workflow-action URLs before processing them. A user with the "power" role can embed malicious SPL in a workflow action. When another user selects this action and continues, the SPL runs with the victim's permissions, allowing unauthorized data access or modification. Exploitation requires social engineering (phishing) to induce the victim to trigger the malicious action. The "power" role user cannot exploit this vulnerability directly without victim interaction.

An attacker with the "power" role can craft malicious SPL embedded in a Dashboard Studio workflow action. If an authenticated user is tricked into triggering this action, the SPL executes with their permissions, potentially leading to unauthorized data access or modification. This can compromise confidentiality and integrity of data accessible to the victim user. Availability is not impacted. The attack requires user interaction via phishing, limiting the ease of exploitation.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, restrict the assignment of the "power" role to trusted users and educate users to be cautious of phishing attempts involving Dashboard Studio actions.