In affected versions of Splunk Enterprise, a user with the "power" role can embed malicious SPL in Dashboard Studio workflow actions. When another authenticated user selects and continues the action, the injected SPL executes with their permissions, allowing data access or modification. This vulnerability stems from inadequate validation of workflow-action URLs before request submission. Exploitation depends on phishing to induce the targeted user to trigger the malicious SPL execution. The vulnerability is tracked as CVE-2026-76334 and has a CVSS 3.1 base score of 6.4 (medium severity).

An attacker with the "power" role can craft a malicious workflow action that, when triggered by another authenticated user, executes arbitrary SPL commands with that user's privileges. This can lead to unauthorized access or modification of data accessible to the victim user. The vulnerability requires user interaction via phishing, limiting direct exploitation. There is no indication of impact on system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, mitigate risk by limiting the assignment of the "power" role to trusted users only and educating users to avoid phishing attempts that could trigger malicious workflow actions.