CVE-2026-76341

Received Received - Intake

Stored XSS in Splunk Enterprise Table Editor

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language (SPL) in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the SPL when that user opens the dataset in the Table Editor. The SPL runs using the permissions of the second user and could expose all relevant data and modify limited data on the search head. The vulnerability is possible because the Table Editor does not apply SPL safeguards for risky commands when it prepares the dataset initial data. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see Define initial data for a new table dataset (https://help.splunk.com/en/splunk-enterprise/manage-knowledge-objects/knowledge-management-manual/9.4/create-and-edit-table-datasets/define-initial-data-for-a-new-table-dataset), SPL safeguards for risky commands (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/best-practices-for-splunk-platform-security/spl-safeguards-for-risky-commands), and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-76341

EUVD

EUVD-2026-62906

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk_enterprise	9.4.14
splunk	splunk_enterprise	10.0.9
splunk	splunk_enterprise	10.2.6
splunk	splunk_enterprise	10.4.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the 'power' role can store malicious Search Processing Language (SPL) in a Table Editor dataset and share it. When an 'admin' user opens the dataset, the SPL executes with the admin's permissions, potentially exposing or modifying data. The issue occurs because the Table Editor does not enforce SPL safeguards for risky commands during dataset initialization.

Detection Guidance

Check Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 for vulnerable installations. Review Table Editor datasets created by users with the 'power' role for suspicious SPL commands. Monitor for unauthorized data access or modifications by admin users.

Impact Analysis

An attacker could trick a user with the 'power' role into sharing a malicious dataset. If an 'admin' user opens it, the embedded SPL could access sensitive data or make limited unauthorized changes. The attack requires social engineering to initiate a browser request, but it can lead to data exposure or integrity issues on the Splunk search head.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected Splunk versions may face compliance risks if sensitive data is exposed or altered due to this flaw.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later. Restrict the 'power' role from creating Table Editor datasets. Review and remove any existing datasets created by the 'power' role. Apply SPL safeguards for risky commands as per Splunk documentation.

Hi! I’m here to help you understand CVE-2026-76341. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70