In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a… (CVE-2026-76326)

CVE-2026-76326 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows a user lacking admin or power roles to create a dashboard view that runs arbitrary JavaScript in the browser of another user who views the dashboard and hovers over a sparkline table cell. The root cause is that the dashboard table renderer does not properly restrict or escape tooltip content, enabling cross-site scripting (CWE-79). This can lead to unauthorized access to data and system integrity available to the victim user.

An attacker with limited privileges can execute JavaScript in the context of another user's browser session when that user interacts with a crafted dashboard. This can lead to unauthorized access to sensitive data and compromise system integrity as permitted by the victim user's privileges. The vulnerability does not affect availability and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict dashboard creation permissions to trusted users and educate users about the risk of interacting with untrusted dashboards. Monitor vendor channels for updates and apply official fixes once released.