CVE-2026-76318: Splunk Enterprise XSS Vulnerability

CVE-2026-76318 Overview

CVE-2026-76318 is a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise [CWE-79]. The flaw affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user holding a role with the schedule_search capability can store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script executes in that user's browser with access to their session data. Splunk Web renders the alert threshold value in generated markup without escaping special characters, enabling the injection.

Critical Impact
An authenticated attacker with schedule_search privileges can execute arbitrary JavaScript in the browser of any Splunk user who opens a crafted alert link, exposing session data and dashboards accessible to that user.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6 and 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76318 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76318

Vulnerability Analysis

The vulnerability resides in Splunk Web's rendering of alert trigger condition markup. When a scheduled alert is configured, the alert threshold value is embedded directly into the HTML markup that renders the alert configuration and results view. Splunk Web fails to escape HTML special characters in this value, so any script content stored by an authorized user persists in the alert definition and executes in the DOM context when another user loads the crafted link.

Exploitation requires the attacker to hold a role that includes the schedule_search capability, which is common for power users and analysts who build scheduled searches. Because the script runs in the victim's authenticated session, the attacker can read data the victim can access, exfiltrate session tokens, or issue Splunk REST API calls as the victim.

Root Cause

The root cause is missing output encoding in Splunk Web. The alert threshold value is concatenated into generated markup without HTML entity escaping. This violates standard XSS prevention practices for user-controlled data rendered in an HTML context [CWE-79].

Attack Vector

The attack is network-based and requires user interaction. An attacker with a schedule_search-capable account stores a payload inside an alert trigger condition threshold. The attacker then shares the crafted alert link with a targeted Splunk user. When the victim opens the link in an authenticated Splunk Web session, the browser parses the unescaped markup and executes the injected script. The scope changes from the attacker to the victim, giving the payload access to the victim's data within Splunk Web.

No verified public exploit code is available. See the Splunk Security Advisory SVD-2026-0801 for vendor technical details.

Detection Methods for CVE-2026-76318

Indicators of Compromise

Alert trigger condition thresholds containing HTML tags, <script>, javascript:, or event handler attributes such as onerror= and onload=.
Splunk audit log entries showing alert create or update actions by non-administrative users with the schedule_search capability.
Outbound requests from Splunk Web users to unfamiliar domains immediately after opening a shared alert link.

Detection Strategies

Query the _audit index for action=edit_search and action=alert_action events and inspect the threshold field for markup characters.
Review saved searches via the REST endpoint /services/saved/searches and flag alert.threshold values containing <, >, or &#.
Correlate alert modification events with subsequent authenticated sessions from unusual client IPs to identify session hijacking follow-on activity.

Monitoring Recommendations

Enable browser Content Security Policy reporting on the Splunk Web origin to capture blocked inline script executions.
Alert on newly created scheduled searches whose configuration fields fail an HTML validity check.
Track role assignments that grant schedule_search and review whether the capability is still required.

How to Mitigate CVE-2026-76318

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later.
Audit which users and roles currently hold the schedule_search capability and remove it where not required.
Review existing saved searches and alerts for suspicious content in trigger condition thresholds and remediate any tampered definitions.

Patch Information

Splunk has published fixed versions in Splunk Security Advisory SVD-2026-0801. Apply the patched release corresponding to your maintenance branch. Additional guidance is available in the Splunk documentation on configuring alert trigger conditions and defining roles with capabilities.

Workarounds

Restrict the schedule_search capability to trusted administrators until patching is complete.
Instruct users not to open Splunk alert or search links received from other users through untrusted channels.
Deploy a restrictive Content Security Policy on the Splunk Web origin to block inline script execution.

bash

# Review users with the schedule_search capability
/opt/splunk/bin/splunk list role -auth admin:<password> \
  | grep -B1 schedule_search

# Inspect alert thresholds for suspicious markup
curl -k -u admin:<password> \
  https://splunk.example.com:8089/services/saved/searches \
  | grep -E 'alert\.threshold.*(<|javascript:|onerror=)'