CVE-2026-20257

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Enterprise versions prior to 9.4.12 Splunk Enterprise versions prior to 9.3.13 Splunk Cloud Platform versions prior to 10.3.2512.13 Splunk Cloud Platform versions prior to 10.2.2510.15 Splunk Cloud Platform versions prior to 10.1.2507.23 Splunk Cloud Platform versions prior to 9.3.2411.132

Description A low-privileged user without admin or power roles can create a classic dashboard designed to exfiltrate sensitive data from the browser of a higher-privileged user. This occurs because classic dashboard panels fail to fully validate style attribute values, enabling requests to be sent to external domains that are not included in the Trusted Domains List. Exploitation requires the attacker to phish the victim into initiating a request within their browser.

Recommendations Update Splunk Enterprise to version 10.2.4 or later. Update Splunk Enterprise to version 10.0.7 or later. Update Splunk Enterprise to version 9.4.12 or later. Update Splunk Enterprise to version 9.3.13 or later. Update Splunk Cloud Platform to version 10.3.2512.13 or later. Update Splunk Cloud Platform to version 10.2.2510.15 or later. Update Splunk Cloud Platform to version 10.1.2507.23 or later. Update Splunk Cloud Platform to version 9.3.2411.132 or later.