CVE-2026-76333: Splunk Enterprise XSS Vulnerability

CVE-2026-76333 Overview

CVE-2026-76333 is a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise Dashboard Studio [CWE-79]. A user assigned the power Splunk role can save a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user opens Event Actions and selects the stored action, attacker-controlled JavaScript executes in the victim's browser session. The flaw stems from insufficient validation of workflow-action URLs before processing. Successful exploitation exposes data and actions accessible through Splunk Web under the victim's identity.

Critical Impact
Authenticated power users can execute arbitrary JavaScript in the browser of any user who triggers the malicious workflow action, enabling session abuse and data theft within Splunk Web.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6 and 10.0.9
Splunk Enterprise versions below 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76333 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76333

Vulnerability Analysis

The vulnerability resides in Dashboard Studio's workflow-action handling. Dashboard Studio accepts a URL as part of a workflow action definition and stores it for later invocation from the Event Actions menu. The server-side and client-side code do not sufficiently validate or sanitize the URL scheme and payload before the browser processes it. As a result, a workflow action can carry a JavaScript URI or otherwise craft input that executes script in the DOM context of Splunk Web.

Exploitation is stored and cross-user. An attacker with the power role authors the malicious workflow action once. Any authenticated Splunk user who selects the action from Event Actions and clicks Continue triggers execution. The attacker gains the ability to read data, issue requests, and invoke actions available to the victim through Splunk Web.

Root Cause

Dashboard Studio fails to enforce a strict allowlist on workflow-action URL schemes and does not neutralize script-bearing URIs before dispatch. This maps directly to CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack is network-based but requires user interaction and a low-privilege authenticated foothold. The attacker must hold the power role and must phish or otherwise induce the victim to select the crafted action from Event Actions and press Continue. The power role is not intended to be exploitable at will, so the attacker relies on social engineering to complete the chain. See the Splunk Security Advisory SVD-2026-0801 for vendor-authored technical details.

// No verified public proof-of-concept is available for CVE-2026-76333.
// Refer to Splunk advisory SVD-2026-0801 for vendor-authored details.

Detection Methods for CVE-2026-76333

Indicators of Compromise

Workflow-action definitions in Dashboard Studio containing javascript: URIs, data: URIs, or embedded script fragments in the URL field.
Audit log entries showing creation or modification of workflow actions by accounts holding the power role.
Unexpected outbound requests from Splunk Web sessions to attacker-controlled hosts shortly after Event Actions invocations.

Detection Strategies

Inspect stored workflow-action configurations for URL values that deviate from expected http:// or https:// schemes bound to approved destinations.
Correlate _audit index events for edit_dashboard and workflow-action changes with the identity of power-role users.
Alert on Splunk Web sessions issuing anomalous DOM-initiated requests or referrer patterns following action selection.

Monitoring Recommendations

Enable and forward Splunk internal audit logs to a centralized log platform for cross-user correlation.
Baseline the population of accounts holding the power role and alert on privilege additions.
Review Dashboard Studio saved objects on a scheduled basis and flag workflow actions authored by non-administrator accounts.

How to Mitigate CVE-2026-76333

Immediate Actions Required

Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later as applicable to the deployment.
Audit all existing Dashboard Studio workflow actions and remove entries containing non-HTTP(S) URL schemes or script payloads.
Review and reduce assignments of the power role to the minimum set of trusted operators.

Patch Information

Splunk has published fixed builds in the 10.4.2, 10.2.6, 10.0.9, and 9.4.14 release lines. Apply the vendor patch matching your maintenance branch as documented in Splunk Security Advisory SVD-2026-0801.

Workarounds

Restrict the edit_dashboard and workflow-action authoring capabilities to administrators until patched, following Define roles on the Splunk platform with capabilities.
Train Splunk Web users to avoid selecting Event Actions authored by untrusted parties and to verify workflow-action URLs before clicking Continue.
Enforce Content Security Policy and browser isolation for Splunk Web where feasible to limit script execution impact.

bash

# Example: list users holding the power role for review
$SPLUNK_HOME/bin/splunk list user -auth admin:<password> \
  | grep -i "roles:.*power"

# Example: remove the power role from an account pending review
$SPLUNK_HOME/bin/splunk edit user <username> -role user -auth admin:<password>