CVE-2026-76333

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description Dashboard Studio fails to sufficiently validate workflow-action URLs before processing them. A user with the "power" role can store a crafted URL within a Dashboard Studio workflow action. If another authenticated user selects this action from Event Actions and clicks Continue, attacker-controlled JavaScript executes in that user's browser. This can lead to the exposure of data or actions available through Splunk Web. Exploitation requires the attacker to phish the target user into initiating the request.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.