CVE-2026-20257
Analyzed Analyzed - Analysis Complete
Classic Dashboard Data Exfiltration in Splunk Enterprise

Publication date: 2026-06-10

Last updated on: 2026-06-15

Assigner: Cisco Systems, Inc.

Description
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a classic dashboard that exfiltrates sensitive data from the browser of a higher-privileged user who views it. The exfiltration is possible because classic dashboard panels do not fully validate style attribute values, which can allow for requests to reach external domains outside the configured Trusted Domains List. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-15
Generated
2026-06-17
AI Q&A
2026-06-10
EPSS Evaluated
2026-06-16
NVD
CVE-2026-20257
EUVD
EUVD-2026-36085
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
splunk splunk From 10.0.0 (inc) to 10.0.7 (exc)
splunk splunk From 10.2.0 (inc) to 10.2.4 (exc)
splunk splunk From 9.3.0 (inc) to 9.3.13 (exc)
splunk splunk From 9.4.0 (inc) to 9.4.12 (exc)
splunk splunk_cloud_platform From 9.3.2411 (inc) to 9.3.2411.132 (exc)
splunk splunk_cloud_platform From 10.1.2507 (inc) to 10.1.2507.23 (exc)
splunk splunk_cloud_platform From 10.2.2510 (inc) to 10.2.2510.15 (exc)
splunk splunk_cloud_platform From 10.3.2512 (inc) to 10.3.2512.13 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

This vulnerability allows a low-privileged user to exfiltrate sensitive data from the browser of a higher-privileged user by exploiting improper input validation in classic dashboard CSS. Such unauthorized data exfiltration could lead to exposure of sensitive or personal data.

Exposure of sensitive data due to this vulnerability may impact compliance with data protection regulations such as GDPR and HIPAA, which require organizations to protect personal and sensitive information from unauthorized access or disclosure.

Mitigations include upgrading to patched versions, configuring the Dashboards Trusted Domains List to restrict external domains, and reviewing role-based permissions, which can help reduce the risk of non-compliance.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Splunk Enterprise to version 10.4.0 or higher, or apply the specified patches for older versions.

For Splunk Cloud Platform, affected instances are being actively patched by the vendor.

Additional mitigations include configuring the Dashboards Trusted Domains List to restrict external domains and reviewing role-based permissions for dashboard creation and editing.

Executive Summary

CVE-2026-20257 is a vulnerability in Splunk Enterprise and Splunk Cloud Platform affecting classic dashboards. A low-privileged user without admin or power roles can create a malicious dashboard that exploits improper validation of CSS style attributes. This allows the crafted dashboard to exfiltrate sensitive data from the browser of a higher-privileged user who views it.

The vulnerability arises because classic dashboard panels do not fully validate style attribute values, enabling requests to external domains outside the configured Trusted Domains List. However, the attacker must trick the victim into initiating a request in their browser, so exploitation requires phishing or social engineering.

Impact Analysis

This vulnerability can lead to sensitive data being exfiltrated from the browser of a higher-privileged user when they view a maliciously crafted dashboard. This means confidential information accessible to privileged users could be leaked to external domains controlled by an attacker.

Since exploitation requires tricking the victim into initiating a request, the risk depends on successful phishing or social engineering. The impact is a potential confidentiality breach of sensitive data within the Splunk environment.

Detection Guidance

There are currently no official detection methods or specific commands available to detect this vulnerability on your network or system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart