In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in… (CVE-2026-76346)

CVE-2026-76346 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the "power" role can embed malicious JavaScript in dashboard sparkline format options due to inadequate escaping of tooltip values and lack of restrictions on visualization options in Splunk Web. When another user, particularly one with the "admin" role, views the compromised dashboard, the script executes in their browser context, potentially accessing sensitive data and performing actions with their permissions. Exploitation requires social engineering to induce the victim to initiate a request. The vulnerability is classified as CWE-79 (Cross-site Scripting).

Successful exploitation allows an attacker with "power" role privileges to execute unauthorized JavaScript in the browser of another user who views the affected dashboard. If the victim has "admin" privileges, the attacker can access all data and perform actions available to that user, potentially leading to data exposure and unauthorized operations within Splunk Web. The attack requires user interaction via phishing, limiting its ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the assignment of the "power" role to trusted users only and educate users to be cautious of phishing attempts that could trigger the vulnerability. Monitor Splunk dashboards for suspicious scripts or unusual behavior. Follow Splunk's guidance on configuring role-based user access to minimize risk.