CVE-2026-76324: Splunk Enterprise XSS Vulnerability

CVE-2026-76324 Overview

CVE-2026-76324 is a stored Cross-Site Scripting (XSS) vulnerability in Splunk Enterprise. A user holding the power Splunk role can craft a malicious Splunk Web tour that executes arbitrary JavaScript in another user's browser when that user opens the crafted tour link. The flaw exists because Splunk Web renders tour content and tour navigation links without sufficient output encoding, and accepts a tour selector value that can be treated as markup. Successful exploitation grants the attacker access to data available to the victim within the Splunk Web session. The vulnerability is tracked as CWE-79 and requires victim interaction with the crafted tour link.

Critical Impact
An authenticated power-role user can execute arbitrary JavaScript in a victim's Splunk Web session, exposing session data and enabling actions on behalf of the targeted user.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6 and 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76324 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76324

Vulnerability Analysis

The vulnerability resides in the Splunk Web tour rendering pipeline. Splunk Web serves interactive product tours whose content and navigation links are rendered directly into the DOM. The rendering path fails to apply sufficient output encoding, and the tour selector parameter is interpreted as markup rather than as an inert string value. An attacker with the power Splunk role can create a tour whose content or selector carries HTML and JavaScript payloads. When any authenticated user opens the crafted tour link, the browser parses and executes the injected script under the victim's Splunk Web origin. The scope change reflected in the CVSS vector indicates the attacker payload executes with the victim's privileges rather than the attacker's, expanding impact beyond the attacker's own account.

Root Cause

The root cause is missing contextual output encoding when Splunk Web writes tour content and tour navigation links into HTML sinks. Additionally, the tour selector accepts values that the renderer treats as markup, allowing HTML tags and event handlers to survive into the DOM. Both conditions map to CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires two authenticated Splunk Enterprise users. First, an attacker with the power role authors a malicious tour, embedding script content in fields that Splunk Web later renders unescaped. The attacker then delivers the tour link to a targeted user through internal messaging, email, or any channel that reaches a Splunk operator. When the victim opens the link in an authenticated Splunk Web session, the script executes and can read session tokens, exfiltrate query results, or issue authenticated API calls in the victim's context. The attack requires user interaction and low privileges on the attacker side, and the payload runs within the victim's browser origin.

No verified public proof-of-concept code is available. See the Splunk Security Advisory SVD-2026-0801 for vendor technical details.

Detection Methods for CVE-2026-76324

Indicators of Compromise

Splunk Web tour objects created by non-administrative accounts containing HTML tags, <script> elements, on* event handler attributes, or javascript: URIs in tour content, navigation links, or the tour selector field.
Unexpected outbound requests from user browsers to attacker-controlled hosts immediately after loading a tour URL under /en-US/app/*/tour or similar tour endpoints.
Audit log entries showing tour creation or modification by power-role users followed by tour link access from higher-privileged accounts.

Detection Strategies

Query Splunk internal audit and configuration logs (index=_audit, index=_internal) for POST or PUT operations against tour endpoints and inspect payloads for markup characters such as <, >, and =".
Alert on Splunk Web sessions where a power-role account creates tours that are subsequently viewed by admin-role users.
Correlate browser Content Security Policy (CSP) violation reports from Splunk Web with tour-related URLs.

Monitoring Recommendations

Continuously monitor role assignments and revoke the power role from accounts that do not require tour authoring.
Ingest Splunk Web access logs and audit trails into a centralized data lake and hunt for anomalous tour creation patterns.
Track user-agent and referrer data on tour endpoints to identify unusual access flows.

How to Mitigate CVE-2026-76324

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later according to your deployment branch.
Audit all accounts assigned the power Splunk role and remove the role from users who do not require it.
Review existing tour objects for embedded HTML or JavaScript and delete any suspicious entries prior to patching.

Patch Information

Splunk has released fixed versions in the 10.4.2, 10.2.6, 10.0.9, and 9.4.14 release branches. Refer to the Splunk Security Advisory SVD-2026-0801 for exact fixed builds and upgrade guidance. Apply the patch that matches your currently deployed branch to preserve compatibility with existing apps and configurations.

Workarounds

Restrict assignment of the power role until the patch is applied, since exploitation requires an attacker holding that role.
Instruct users to avoid opening tour links received from other users until the deployment is upgraded.
Enforce a strict Content Security Policy on Splunk Web reverse proxies to reduce the impact of injected inline scripts.

bash

# Verify installed Splunk Enterprise version and identify accounts with the power role
$SPLUNK_HOME/bin/splunk version
$SPLUNK_HOME/bin/splunk list user -auth admin:<password> | grep -B1 "role: power"