CVE-2026-76346: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. in Splunk Splunk Enterprise

This vulnerability in Splunk Enterprise involves improper neutralization of user-controllable input before it is rendered in web pages served to other users. Specifically, a user with the "power" role can embed malicious JavaScript in dashboard sparkline format options. When another user, potentially with "admin" privileges, views the affected dashboard, the script executes in their browser context, potentially exposing sensitive data and allowing actions under their permissions. The root cause is that Splunk Web does not limit dashboard visualization options to safe presentation settings and fails to escape tooltip values before rendering. Exploitation requires social engineering to induce the victim to load the malicious dashboard content. The affected versions are those before 10.4.2, 10.2.6, 10.0.9, and 9.4.14.

Successful exploitation can lead to unauthorized JavaScript execution in the context of another user's browser, potentially exposing sensitive data accessible to that user and allowing actions with their permissions. If the victim user has the "admin" role, the attacker can access all relevant data available through Splunk Web and perform privileged actions. However, exploitation requires phishing to trick the victim into initiating a request, and the attacker must have the "power" role to store the malicious script. The vulnerability does not allow the "power" role user to exploit it at will without victim interaction.

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that address this vulnerability. Users should upgrade to these versions or later to remediate the issue. Additionally, administrators should carefully manage role assignments to limit the "power" role to trusted users and educate users about phishing risks. Since this is a stored XSS vulnerability requiring victim interaction, reducing phishing susceptibility is important. No other specific mitigations are indicated in the advisory.