CVE-2026-76326 Splunk CVE debrief

Who should care

Splunk Enterprise administrators and users with dashboard editing privileges should be aware of this vulnerability and take steps to mitigate it. Additionally, users who rely on Splunk Enterprise for data analysis and monitoring should be cautious when opening dashboards created by other users.

Technical summary

A user who does not hold the 'admin' or 'power' Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell. This allows for access to all relevant data available to that user. The vulnerability is possible because the dashboard table renderer does not sufficiently restrict tooltip options or escape tooltip content before display.

Defensive priority

Medium-priority defensive review recommended due to potential for user-assisted data access.

Recommended defensive actions

• Review and apply vendor patches for Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.
• Restrict dashboard view editing to users with 'admin' or 'power' Splunk roles.
• Monitor dashboard usage and user activity for potential suspicious behavior.
• Implement compensating controls, such as Web Application Firewalls, to detect and prevent JavaScript injection attempts.
• Conduct regular inventory checks to ensure all Splunk Enterprise instances are up-to-date and patched.

Evidence notes

Evidence from official sources indicates a medium-severity vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user without 'admin' or 'power' roles could store a dashboard view that runs JavaScript in another user's browser when hovering over a sparkline table cell, potentially allowing access to relevant data available to that user.

Official resources