CVE-2026-20255

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Enterprise versions prior to 9.4.12 Splunk Enterprise versions prior to 9.3.13 Splunk Cloud Platform versions prior to 10.3.2512.13 Splunk Cloud Platform versions prior to 10.2.2510.15 Splunk Cloud Platform versions prior to 10.1.2507.23 Splunk Cloud Platform versions prior to 9.3.2411.132

Description A low-privileged user without "admin" or "power" roles can create a malicious classic dashboard to exfiltrate sensitive data to an external server. This occurs due to incomplete URL validation within the external content dialog, which allows requests to be sent to untrusted domains when a user interacts with the crafted dashboard.

Recommendations Update Splunk Enterprise to version 10.2.4 or later. Update Splunk Enterprise to version 10.0.7 or later. Update Splunk Enterprise to version 9.4.12 or later. Update Splunk Enterprise to version 9.3.13 or later. Update Splunk Cloud Platform to version 10.3.2512.13 or later. Update Splunk Cloud Platform to version 10.2.2510.15 or later. Update Splunk Cloud Platform to version 10.1.2507.23 or later. Update Splunk Cloud Platform to version 9.3.2411.132 or later.