In affected versions of Splunk Enterprise (9.4, 10.0, 10.2, 10.4), a user with the "power" role can embed malicious Search Processing Language (SPL) in Dashboard Studio workflow actions. When another authenticated user selects this action and confirms, the injected SPL executes with the victim's permissions. This occurs because Dashboard Studio does not sufficiently validate workflow-action URLs before submitting requests. Exploitation requires phishing to trick the victim user into initiating the request. The vulnerability allows unauthorized access or modification of data accessible to the victim user. The attacker with the "power" role cannot exploit this vulnerability without involving another user.

The vulnerability can lead to unauthorized data access or modification by executing attacker-controlled SPL commands with the permissions of an authenticated user who triggers the malicious workflow action. This could compromise confidentiality and integrity of data accessible to the victim user. There is no indication of availability impact. Exploitation requires social engineering (phishing) to induce the victim user to initiate the malicious request.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit the assignment of the "power" role to trusted users only and educate users about phishing risks. Monitor for suspicious workflow actions and avoid triggering untrusted workflow actions. Follow vendor guidance when it becomes available.