CVE-2026-20256

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Enterprise versions prior to 9.4.12 Splunk Enterprise versions prior to 9.3.13 Splunk Cloud Platform versions prior to 10.3.2512.13 Splunk Cloud Platform versions prior to 10.2.2510.15 Splunk Cloud Platform versions prior to 10.1.2507.23 Splunk Cloud Platform versions prior to 9.3.2411.132

Description A low-privileged user without 'admin' or 'power' roles can cause data exfiltration via classic dashboards. This is possible by redirecting a victim to an external site using a protocol-relative URL in a drill-down link. The issue occurs because the URL classifier in classic dashboards only identifies http:// and https:// schemes as external, allowing protocol-relative URLs (e.g., //attacker.com) to bypass the check and avoid the external-navigation warning dialog in Splunk Web.

Recommendations Update Splunk Enterprise to version 10.2.4 or later. Update Splunk Enterprise to version 10.0.7 or later. Update Splunk Enterprise to version 9.4.12 or later. Update Splunk Enterprise to version 9.3.13 or later. Update Splunk Cloud Platform to version 10.3.2512.13 or later. Update Splunk Cloud Platform to version 10.2.2510.15 or later. Update Splunk Cloud Platform to version 10.1.2507.23 or later. Update Splunk Cloud Platform to version 9.3.2411.132 or later.