CVE-2026-76325: Splunk Enterprise XSS Vulnerability

CVE-2026-76325 Overview

CVE-2026-76325 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in Splunk Enterprise. A user holding the power Splunk role can store a malicious ui-tour knowledge object that matches an auto-tour page name and share it at the app level. When another authenticated user visits a standard Splunk Web page, the crafted tour content executes arbitrary JavaScript in that user's browser session.

The flaw affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Attackers can leverage the executed script to exfiltrate session data and modify application state within the victim's permissions.

Critical Impact
A low-privilege power role user can execute arbitrary JavaScript in higher-privileged users' browsers, exposing sensitive data and compromising system integrity within the victim's permission scope.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6, 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76325 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76325

Vulnerability Analysis

Splunk Web supports guided auto-tours that render UI walkthroughs on specific pages. Splunk Web resolves auto-tour entries from the app namespace and incorporates tour content when constructing the tour image element. The application treats this content as trusted, but it originates from a user-editable knowledge object.

A user with the power role can create a ui-tour knowledge object whose name collides with an auto-tour page name and share it across the app. When a second authenticated user loads the affected Splunk Web page, the browser parses the attacker-controlled tour payload and executes the embedded JavaScript. The script runs in the victim's authenticated session context.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation [CWE-79]. Splunk Web resolves ui-tour objects from the app namespace without validating the trust boundary between built-in tour content and user-created knowledge objects. The tour image builder concatenates untrusted attributes into the rendered DOM.

Attack Vector

The attack requires network access to Splunk Web, low privileges (power role), and user interaction because the victim must load a Splunk Web page that triggers the auto-tour. The attacker stores the payload once; each subsequent visit by an authenticated user executes the injected script under that user's permissions. Exploitation does not require the victim to click a crafted link.

See the Splunk Security Advisory SVD-2026-0801 for vendor technical details.

Detection Methods for CVE-2026-76325

Indicators of Compromise

Newly created or modified ui-tour knowledge objects shared at the app level by non-admin users.
ui-tour object names that match built-in Splunk auto-tour page identifiers.
Splunk Web audit entries showing knowledge object edits followed by session activity spikes on Splunk Web pages that trigger tours.

Detection Strategies

Audit _audit index events for action=edit on ui-tour objects, filtering by users holding the power role rather than admin.
Inspect data/ui/ui-tour REST endpoint contents for entries containing HTML tags, javascript: URIs, or event handler attributes such as onerror and onload.
Correlate browser Content Security Policy violation reports with Splunk Web page loads to surface script execution attempts.

Monitoring Recommendations

Enable and forward Splunk Web access logs and _audit index events to a centralized analytics platform for review.
Alert on any sharing scope change of ui-tour objects from user to app or global.
Track anomalous Splunk API calls originating from user sessions immediately after tour-enabled page visits.

How to Mitigate CVE-2026-76325

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later versions as listed in the vendor advisory.
Review all existing ui-tour knowledge objects and remove or restrict any created by non-administrative users.
Restrict assignment of the power role to trusted users and audit current role membership.

Patch Information

Splunk released fixed builds in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Refer to the Splunk Security Advisory SVD-2026-0801 for full patch details and download links.

Workarounds

Remove the edit_tours capability from the power role and any custom roles that do not require it.
Restrict app-level sharing of ui-tour knowledge objects through role-based capability controls.
Deploy a strict Content Security Policy on Splunk Web to limit inline script execution surface.

bash

# Example: remove edit_tours capability from the power role via authorize.conf
# $SPLUNK_HOME/etc/system/local/authorize.conf
[role_power]
edit_tours = disabled

# Reload authorization without restart
splunk reload auth