CVE-2026-20258 Overview
CVE-2026-20258 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting Splunk Enterprise and Splunk Cloud Platform. A low-privileged user who does not hold the admin or power Splunk roles can store malicious JavaScript inside a classic dashboard HTML panel. When another authenticated user is tricked into loading the crafted dashboard, the injected script executes in their browser session.
Exploitation requires user interaction through phishing, and the attacker cannot trigger the payload at will. Despite these constraints, successful execution can compromise the victim's Splunk session and any data accessible through it.
Critical Impact
Stored JavaScript executes in a victim's authenticated Splunk session, enabling session theft, unauthorized search execution, and lateral access to indexed data.
Affected Products
- Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13
- Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132
- Classic dashboards using HTML panels
Discovery Timeline
- 2026-06-10 - CVE-2026-20258 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-20258
Vulnerability Analysis
The vulnerability resides in how Splunk's classic dashboard framework renders HTML panels. HTML panels permit raw markup as part of dashboard definitions, and the rendering pipeline fails to adequately sanitize script-bearing content supplied by lower-privileged authors. As a result, an attacker with dashboard creation rights can persist arbitrary JavaScript in a dashboard definition.
When a privileged user opens the dashboard, the browser parses the malicious markup in the context of the Splunk web origin. The script can then issue authenticated requests to Splunk REST endpoints, exfiltrate search results, alter dashboards, or pivot to administrative functions if an admin-role user is the victim.
Root Cause
The underlying defect is improper neutralization of input during web page generation, classified as [CWE-79]. Splunk's classic dashboard HTML panel preserved untrusted markup from non-privileged authors and rendered it without strict output encoding or a restrictive content security policy capable of blocking inline script execution.
Attack Vector
The attacker authenticates with low privileges, creates or edits a classic dashboard, and embeds malicious JavaScript inside an HTML panel. The attacker then phishes a higher-privileged user with a link or social-engineered request that loads the dashboard. The high attack complexity reflects the required user interaction and the inability to trigger execution at will. See the Splunk Security Advisory SVD-2026-0608 for vendor technical details.
Detection Methods for CVE-2026-20258
Indicators of Compromise
- Classic dashboard definitions containing <script>, onerror=, onload=, or javascript: strings inside HTML panel XML
- Audit log entries showing dashboard create or edit actions by users lacking the admin or power roles
- Unexpected outbound browser requests originating from Splunk Web sessions to attacker-controlled domains
Detection Strategies
- Query the data/ui/views REST endpoint and inspect saved dashboards for HTML panels containing executable JavaScript constructs.
- Correlate Splunk _audit index events for action=edit on dashboards with the actor's role assignments to flag low-privileged authors modifying shared dashboards.
- Monitor browser-side telemetry for Splunk Web sessions issuing anomalous XHR or fetch calls to non-Splunk hosts.
Monitoring Recommendations
- Establish alerts on dashboard XML changes by non-administrative principals and require review before publication to shared apps.
- Track viewing patterns where low-privileged authors share dashboards directly with admin-role users shortly after edits.
- Capture Splunk Web CSP violation reports if a report-only policy is deployed during remediation.
How to Mitigate CVE-2026-20258
Immediate Actions Required
- Upgrade Splunk Enterprise to 10.2.4, 10.0.7, 9.4.12, 9.3.13, or later maintenance releases on those branches.
- Confirm Splunk Cloud Platform tenants are running 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132, or later.
- Audit all classic dashboards authored by non-administrative users and remove unsanctioned HTML panels.
Patch Information
Splunk released fixed versions documented in Splunk Security Advisory SVD-2026-0608. Splunk Cloud Platform customers receive the patch through the vendor's managed update process. On-premises Splunk Enterprise administrators must apply the upgrade manually following the standard release notes for their branch.
Workarounds
- Restrict dashboard authoring capabilities so only admin and power role holders can create or edit classic dashboards in shared apps.
- Disable or remove HTML panels from classic dashboards where Simple XML or Dashboard Studio alternatives can be used.
- Train users to avoid opening dashboard links delivered through unsolicited messages until patches are deployed.
# Identify classic dashboards containing HTML panels for review
grep -RIl --include='*.xml' '<html>' $SPLUNK_HOME/etc/apps/*/local/data/ui/views/
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
