CVE-2026-76334

Received Received - Intake

Splunk Enterprise Dashboard Studio SPL Injection

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language (SPL). When another authenticated user selects the action from Event Actions and selects Continue, Splunk Enterprise runs the injected SPL using the permissions of that user. The injected SPL could access or modify data available to that user. The vulnerability is possible because Dashboard Studio does not sufficiently validate workflow-action URLs before submitting requests. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76334

EUVD

EUVD-2026-62899

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	10.4.2
splunk	splunk_enterprise	10.2.6
splunk	splunk_enterprise	10.0.9
splunk	splunk_enterprise	9.4.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the 'power' role can store a malicious Dashboard Studio workflow action containing attacker-controlled SPL. When another user selects this action and clicks Continue, Splunk runs the injected SPL using the victim's permissions, potentially accessing or modifying their data.

Impact Analysis

If you use Splunk Enterprise with a vulnerable version, an attacker could trick you into clicking a malicious workflow action. This could allow them to access or modify your data, even if they don't have direct access to your account. The attacker needs to phish you into initiating the request.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating compliance requirements for GDPR, HIPAA, and other regulations that mandate strict data protection and access controls. Organizations using vulnerable Splunk versions may face compliance violations if exploited.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later to address the vulnerability. Ensure users with the 'power' role are restricted from creating or modifying Dashboard Studio workflow actions. Monitor for suspicious activity in Dashboard Studio workflow actions and review user permissions regularly.

Hi! I’m here to help you understand CVE-2026-76334. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70