CVE-2026-20258
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Summary
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user.
The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Splunk | Splunk Enterprise | 10.2 < 10.2.4 | affected |
| Splunk | Splunk Enterprise | 10.0 < 10.0.7 | affected |
| Splunk | Splunk Enterprise | 9.4 < 9.4.12 | affected |
| Splunk | Splunk Enterprise | 9.3 < 9.3.13 | affected |
| Splunk | Splunk Cloud Platform | 10.3.2512 < 10.3.2512.11 | affected |
| Splunk | Splunk Cloud Platform | 10.2.2510 < 10.2.2510.15 | affected |
| Splunk | Splunk Cloud Platform | 10.1.2507 < 10.1.2507.23 | affected |
| Splunk | Splunk Cloud Platform | 9.3.2411 < 9.3.2411.132 | affected |
Weaknesses
- CWE-79: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.