CVE-2026-76328 Splunk CVE debrief

Who should care

Splunk Enterprise administrators and users with the 'power' role should be aware of this vulnerability and take necessary actions to prevent exploitation. Additionally, users who export dashboards as PDFs should be cautious of potential phishing attempts.

Technical summary

A user with the 'power' Splunk role can store attacker-controlled Search Processing Language (SPL) in a dashboard. When another authenticated user exports the dashboard as a PDF file, Splunk Enterprise runs the injected SPL using the permissions of that user, potentially allowing access or modification of data available to that user. The vulnerability requires user interaction to exploit, as the attacker must phish the affected user to initiate a request within their browser. The affected versions include Splunk Enterprise below 10.4.1, 10.2.6, 10.0.9, and 9.4.14. To mitigate, restrict the 'power' Splunk role to trusted users, monitor their activities, and implement compensating controls such as validating dashboard content before processing PDF exports.

Defensive priority

Medium-priority defensive actions are required to address this vulnerability, as it allows for potential data access or modification by injecting SPL. Users with the 'power' Splunk role could exploit this by storing malicious SPL in a dashboard, which would then be executed when another authenticated user exports the dashboard as a PDF.

Recommended defensive actions

• Inventory and check for affected Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14.
• Restrict the 'power' Splunk role to trusted users and monitor their activities.
• Implement compensating controls, such as validating dashboard content before processing PDF exports.
• Apply vendor remediation by upgrading to Splunk Enterprise version 10.4.1, 10.2.6, 10.0.9, or 9.4.14.
• Monitor for suspicious dashboard exports and user activities.

Evidence notes

Evidence from the NVD and Splunk advisory indicates that affected versions include Splunk Enterprise below 10.4.1, 10.2.6, 10.0.9, and 9.4.14. The vulnerability requires user interaction to exploit, as the attacker must phish the affected user to initiate a request within their browser.

Official resources