CVE-2026-76328 Overview
CVE-2026-76328 is a command injection vulnerability [CWE-77] in Splunk Enterprise affecting versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14. A user assigned the power Splunk role can store attacker-controlled Search Processing Language (SPL) inside a dashboard. When another authenticated user exports that dashboard as a Portable Document Format (PDF), Splunk Web runs the injected SPL under the exporting user's permissions. Splunk Web fails to sufficiently validate dashboard content before generating PDF exports. Successful exploitation requires phishing the target user to initiate the export request in their browser.
Critical Impact
Injected SPL runs with the victim user's permissions and can read or modify any data accessible to that account.
Affected Products
- Splunk Enterprise versions below 10.4.1
- Splunk Enterprise versions below 10.2.6 and 10.0.9
- Splunk Enterprise versions below 9.4.14
Discovery Timeline
- 2026-08-19 - CVE-2026-76328 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76328
Vulnerability Analysis
The flaw sits in the PDF export path of Splunk Web. Dashboards can embed SPL statements that are evaluated when the dashboard renders. During PDF generation, Splunk Web processes stored dashboard content without adequate validation of the embedded SPL. This lets a lower-privileged author inject SPL that executes in the security context of whoever triggers the PDF export.
The attack blends stored injection with a phishing step. The power role user cannot execute the injected SPL on demand. They must wait for a targeted user to click a crafted link or initiate the export from their browser. Once the export runs, the injected SPL inherits the victim's read and write access to Splunk indexes and knowledge objects.
Root Cause
The root cause is improper neutralization of special elements used in a command [CWE-77]. Splunk Web trusts dashboard content authored by power role users and passes embedded SPL into the PDF rendering pipeline without server-side validation or context-aware sanitization.
Attack Vector
An authenticated attacker with the power role saves a dashboard containing malicious SPL payloads. The attacker then phishes a higher-privileged user, directing them to open the dashboard and initiate PDF export. The victim's browser posts the request to Splunk Web, which renders the dashboard server-side and executes the injected SPL under the victim's identity. Refer to the Splunk Security Advisory SVD-2026-0801 for vendor-confirmed technical details.
Detection Methods for CVE-2026-76328
Indicators of Compromise
- Dashboard XML or JSON definitions modified by power role accounts containing unexpected SPL commands such as | outputlookup, | collect, | sendemail, or | script.
- PDF export jobs (pdfgen or sendjob audit events) initiated by privileged users shortly after receiving external links referencing dashboard URLs.
- Search audit logs showing SPL executed under a user identity that does not match the dashboard owner.
Detection Strategies
- Review _audit index entries for action=search events tied to PDF generation and correlate with the dashboard's original author.
- Compare dashboard revision history against a baseline to identify SPL statements added by non-admin roles.
- Alert on outbound PDF export requests that follow inbound emails or referrers from untrusted domains.
Monitoring Recommendations
- Enable and forward Splunk _internal and _audit indexes to a centralized SIEM for cross-user correlation.
- Track privilege usage patterns for accounts with roles above power that render PDFs authored by lower-privileged users.
- Monitor for anomalous | outputlookup or | collect operations occurring during PDF export sessions.
How to Mitigate CVE-2026-76328
Immediate Actions Required
- Upgrade Splunk Enterprise to 10.4.1, 10.2.6, 10.0.9, 9.4.14, or later.
- Audit accounts assigned the power role and remove the capability where not required.
- Warn privileged users against exporting dashboards to PDF from unsolicited links or emails.
Patch Information
Splunk has released fixed builds in the 10.4.1, 10.2.6, 10.0.9, and 9.4.14 release lines. Details are documented in the Splunk Security Advisory SVD-2026-0801.
Workarounds
- Disable PDF export for dashboards created by non-administrative roles until patching completes.
- Restrict the schedule_search and pdfgen capabilities to trusted roles only.
- Enforce dashboard review workflows so that dashboards authored by power role users are validated before privileged users interact with them.
# Configuration example: restrict PDF generation capability
# In $SPLUNK_HOME/etc/system/local/authorize.conf
[role_power]
schedule_search = disabled
pdfgen = disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
