CVE-2026-76334 Overview
CVE-2026-76334 is a stored injection vulnerability in Splunk Enterprise Dashboard Studio. A user holding the power Splunk role can store a Dashboard Studio workflow action containing attacker-controlled Search Processing Language (SPL). When another authenticated user selects the action from Event Actions and clicks Continue, Splunk Enterprise executes the injected SPL under the victim's permissions. The flaw exists because Dashboard Studio does not sufficiently validate workflow-action URLs before submitting requests. The vulnerability maps to [CWE-352] Cross-Site Request Forgery and requires user interaction through a phishing-style lure.
Critical Impact
A power-role user can coerce higher-privileged users into executing arbitrary SPL, enabling unauthorized access to or modification of data available to the victim.
Affected Products
- Splunk Enterprise versions below 10.4.2
- Splunk Enterprise versions below 10.2.6 and 10.0.9
- Splunk Enterprise versions below 9.4.14
Discovery Timeline
- 2026-08-19 - CVE-2026-76334 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76334
Vulnerability Analysis
The vulnerability resides in the Dashboard Studio workflow-action handling logic within Splunk Enterprise. Workflow actions allow users to define custom URLs invoked from Event Actions inside dashboards. Dashboard Studio fails to validate these URLs before submitting requests, allowing embedded SPL payloads to reach the search endpoint.
A user with the power role can save a crafted workflow action that references an attacker-controlled URL containing SPL. When a victim opens the action and confirms via Continue, the browser submits the request under the victim's session. Splunk then runs the SPL with the victim's permissions, which may exceed those of the power role.
The attacker cannot trigger execution at will. Success requires phishing or social engineering to make the victim initiate the action from their browser, consistent with the [CWE-352] classification.
Root Cause
Dashboard Studio does not enforce sufficient validation on workflow-action URLs. Because the client submits the request from within an authenticated session, Splunk treats the injected SPL as legitimate user input and runs it with the caller's privileges.
Attack Vector
The attack chain requires three conditions: an attacker holding the power role, a victim with elevated Splunk permissions, and successful phishing that convinces the victim to trigger the stored workflow action. Upon execution, the injected SPL can read or alter any data the victim can access, including indexed events and configuration objects.
No verified public exploit code is available. Refer to the Splunk Security Advisory SVD-2026-0801 for vendor technical details.
Detection Methods for CVE-2026-76334
Indicators of Compromise
- Workflow action definitions in Dashboard Studio that reference unusual or external URLs containing SPL keywords such as search, | delete, or | outputlookup.
- Audit log entries showing SPL searches initiated from Event Actions immediately following user interaction with a shared dashboard.
- Unexpected data modification or lookup writes executed under the identities of privileged users.
Detection Strategies
- Review _audit index entries for searches attributed to privileged users that originate from workflow-action contexts.
- Enumerate stored workflow actions across Dashboard Studio artifacts and flag any created or modified by power-role accounts.
- Correlate Splunk web access logs with search execution events to identify SPL delivered via workflow-action URLs.
Monitoring Recommendations
- Alert on creation or modification of workflow actions by non-admin users, especially accounts holding the power role.
- Monitor for outbound HTTP requests from the Splunk web tier to attacker-controlled domains referenced in workflow actions.
- Track search-job creation metadata to identify SPL executed with parameters inconsistent with the initiating user's normal activity.
How to Mitigate CVE-2026-76334
Immediate Actions Required
- Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later as applicable to your deployment.
- Audit all existing Dashboard Studio workflow actions and remove any containing suspicious URLs or SPL payloads.
- Review assignments of the power role and revoke it from accounts that do not require it.
Patch Information
Splunk released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Consult the Splunk Security Advisory SVD-2026-0801 for full remediation guidance and download links.
Workarounds
- Restrict the power role from creating or editing Dashboard Studio workflow actions until patches are applied.
- Train users to inspect Event Action prompts and avoid clicking Continue on unfamiliar workflow actions.
- Apply strict Content Security Policy and network egress controls on the Splunk web tier to limit request destinations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
