CVE-2026-76346

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user with the "power" role can store a malicious script within dashboard sparkline format options to execute unauthorized JavaScript in the browser of another user viewing the dashboard. If the victim has the "admin" role, the script can access all data available through Splunk Web and perform actions using those permissions. This occurs because Splunk Web fails to limit dashboard visualization options to safe settings and does not escape tooltip values before rendering. Exploitation requires the attacker to phish the target user into initiating a request within their browser.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.