CVE-2026-76346 Overview
CVE-2026-76346 is a stored cross-site scripting (XSS) vulnerability in Splunk Enterprise. A user holding the power Splunk role can embed malicious JavaScript in dashboard sparkline format options. When another user views the dashboard, the script executes in that user's browser session.
If the viewing user holds the admin role, the attacker gains access to data available through Splunk Web and can perform actions with administrator permissions. The flaw exists because Splunk Web does not restrict dashboard visualization options to safe presentation settings and fails to escape tooltip values before rendering. Exploitation requires phishing the victim into initiating the request. The issue is tracked under [CWE-79].
Critical Impact
A low-privileged power user can escalate to admin-level actions by luring an administrator to view a crafted dashboard.
Affected Products
- Splunk Enterprise versions below 10.4.2
- Splunk Enterprise versions below 10.2.6 and 10.0.9
- Splunk Enterprise versions below 9.4.14
Discovery Timeline
- 2026-08-19 - CVE-2026-76346 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-76346
Vulnerability Analysis
CVE-2026-76346 is a stored XSS flaw in Splunk Web's dashboard rendering pipeline. Splunk dashboards support sparkline visualizations with configurable format options. Splunk Web accepts arbitrary values in these options rather than restricting input to a safe allowlist of presentation settings.
When the dashboard renders, tooltip values are inserted into the DOM without HTML escaping. A power role user can save attacker-controlled JavaScript into the sparkline configuration. Any subsequent viewer executes that script in their authenticated Splunk Web session.
The attacker cannot trigger execution at will. The target must be phished into loading the malicious dashboard. When the viewer holds the admin role, the executed script inherits full administrative privileges within Splunk Web, enabling data exfiltration and privileged action forgery.
Root Cause
Two defects combine to produce the vulnerability. First, Splunk Web fails to constrain the permitted dashboard visualization options to safe presentation settings. Second, the rendering logic does not escape tooltip values before inserting them into the page. Together, these gaps allow persisted script payloads to execute during normal dashboard viewing.
Attack Vector
An attacker with power role access authors a dashboard containing a sparkline with malicious format options. The attacker then phishes an administrator into opening the dashboard link. On render, the tooltip payload executes JavaScript under the victim's origin, granting access to Splunk Web APIs and session context. Refer to the Splunk Security Advisory SVD-2026-0801 for vendor-supplied technical details.
Detection Methods for CVE-2026-76346
Indicators of Compromise
- Dashboard XML or JSON configurations containing <script> tags, javascript: URIs, or event handlers such as onerror, onload, or onmouseover in sparkline format options
- Splunk audit log entries showing dashboard saves or edits by power role users targeting visualization configurations
- Anomalous outbound requests from administrator browser sessions to attacker-controlled domains shortly after viewing a shared dashboard
Detection Strategies
- Audit savedsearches.conf and dashboard XML definitions across the deployment for encoded script payloads in sparkline options
- Correlate power role dashboard modification events with subsequent administrator dashboard views to identify potential targeting patterns
- Monitor Splunk Web access logs for administrator sessions issuing unexpected privileged API calls immediately after dashboard rendering
Monitoring Recommendations
- Enable Splunk audit logging for dashboard create, edit, and share events and forward these events to a centralized SIEM
- Alert on any dashboard artifact containing HTML tags, JavaScript keywords, or encoded payloads in visualization option fields
- Track role assignment changes and validate that the power role is granted only to trusted users
How to Mitigate CVE-2026-76346
Immediate Actions Required
- Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later depending on the deployed branch
- Review current assignments of the power role and remove membership for accounts that do not require dashboard authoring privileges
- Instruct administrators to avoid opening dashboards shared by untrusted users until the environment is patched
Patch Information
Splunk has released fixed versions in the 10.4.2, 10.2.6, 10.0.9, and 9.4.14 release lines. Consult the Splunk Security Advisory SVD-2026-0801 for the complete patch matrix and upgrade guidance.
Workarounds
- Restrict the power role to a minimal set of trusted users and prefer custom roles without dashboard editing capabilities where possible
- Enforce role-based access control per the Splunk role-based access documentation
- Deploy browser-side content security policy controls on the Splunk Web origin to limit inline script execution where feasible
# Verify installed Splunk Enterprise version
$SPLUNK_HOME/bin/splunk version
# Review users assigned to the power role
$SPLUNK_HOME/bin/splunk list user -auth admin:<password> | grep -i power
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
