CVE-2026-76326 Overview
CVE-2026-76326 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Splunk Enterprise. A low-privileged authenticated user without the admin or power role can save a dashboard view containing malicious JavaScript. The payload executes in another user's browser when that user opens the dashboard and hovers over a sparkline table cell. The dashboard table renderer does not sufficiently restrict tooltip options or escape tooltip content before rendering.
Critical Impact
A low-privileged user can execute arbitrary JavaScript in a victim's browser session, gaining access to all data and system integrity available to that user within Splunk.
Affected Products
- Splunk Enterprise versions below 10.4.2
- Splunk Enterprise versions below 10.2.6 and 10.0.9
- Splunk Enterprise versions below 9.4.14
Discovery Timeline
- 2026-08-19 - CVE-2026-76326 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76326
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Splunk Enterprise dashboard table renderer. Splunk dashboards support sparkline visualizations inside table cells, and each sparkline exposes tooltip options controllable through the dashboard definition. The renderer accepts tooltip configuration and content from the saved dashboard payload but fails to enforce a restricted allowlist of tooltip options. It also does not HTML-escape the tooltip content before injecting it into the DOM.
An attacker crafts a dashboard view containing a table with a sparkline column. The attacker embeds JavaScript in the tooltip content or in a tooltip option that permits raw markup. When another authenticated user opens the dashboard and hovers over a sparkline cell, the browser renders the tooltip and executes the attacker's script under the victim's Splunk session.
Root Cause
The root cause is insufficient output encoding and missing option validation in the sparkline tooltip code path. The renderer treats tooltip strings as trusted HTML rather than as text, allowing embedded <script> tags and event handlers to execute during tooltip display.
Attack Vector
Exploitation requires an authenticated Splunk user with permission to save a dashboard view, but does not require the elevated admin or power role. Execution requires user interaction: the victim must open the malicious dashboard and hover over an affected sparkline cell. The vulnerability is exploitable over the network through the normal Splunk Web interface.
No verified public exploit code is available. Refer to the Splunk Security Advisory SVD-2026-0801 for vendor technical details.
Detection Methods for CVE-2026-76326
Indicators of Compromise
- Saved dashboard XML or JSON containing sparkline tooltip options with embedded <script>, onerror, onload, or javascript: payloads.
- Unexpected outbound requests from the Splunk Web browser session immediately following a dashboard view load.
- Dashboard modifications authored by non-admin, non-power users that introduce table renderers with custom tooltip content.
Detection Strategies
- Audit the Splunk _internal index and audit logs for dashboard save events performed by non-privileged users and inspect the associated XML for sparkline configurations.
- Scan stored dashboards on the filesystem under $SPLUNK_HOME/etc/users/*/*/local/data/ui/views/ for tooltip attributes containing HTML tags or JavaScript keywords.
- Deploy a Content Security Policy (CSP) in monitoring mode and alert on inline script violations originating from dashboard views.
Monitoring Recommendations
- Log and review all dashboard create and edit operations, correlating the author's role against the presence of sparkline elements.
- Monitor Splunk Web sessions for anomalous API calls made shortly after dashboard rendering, which may indicate session-riding by injected script.
- Track user hover and click telemetry on shared dashboards when browser-side instrumentation is available.
How to Mitigate CVE-2026-76326
Immediate Actions Required
- Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later per the vendor advisory.
- Review all dashboards created or modified by non-admin, non-power users and remove any containing suspicious sparkline tooltip content.
- Restrict dashboard save permissions to trusted users until patching is complete.
Patch Information
Splunk has released fixed versions in the 10.4.2, 10.2.6, 10.0.9, and 9.4.14 branches. Refer to the Splunk Security Advisory SVD-2026-0801 for the complete list of fixed builds and upgrade guidance.
Workarounds
- Limit the ability to create or edit dashboards to users holding the admin or power role via Splunk role-based access control.
- Disable or remove sparkline visualizations in shared dashboards until the upgrade is applied.
- Instruct users to avoid opening dashboards authored by untrusted accounts and to review dashboard sources before hovering over table cells.
# Restrict dashboard write capability for standard users via Splunk CLI
# Review roles and remove edit_dashboard capability from untrusted roles
$SPLUNK_HOME/bin/splunk btool authorize list --debug | grep edit_dashboard
# Example: remove capability from a custom role in authorize.conf
# [role_standard_user]
# edit_dashboard = disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
