CVE-2026-76322
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A user with the "user" role could craft a Dashboard Studio dashboard that runs attacker-controlled SPL for another authenticated user. The attacker-controlled SPL could access all relevant data and affect system integrity and availability. The vulnerability is due to inconsistent enforcement of the expected app-visibility authorization boundary before dashboard search query options reach search dispatch.
Risk Assessment
An attacker could gain access to victim's data or compromise system integrity and availability, potentially leading to severe security breaches.
Recommendation
Upgrade Splunk Enterprise to version 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later to remediate the vulnerability.
Original NVD description (English source)
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that runs attacker-controlled Search Processing Language (SPL) for another authenticated user. The attacker-controlled SPL could access all relevant data and affect system integrity and availability. The vulnerability is possible because Dashboard Studio does not consistently enforce the expected app-visibility authorization boundary before dashboard search query options reach search dispatch. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "user" Splunk role should not be able to exploit the vulnerability at will. For more information see Create search-based visualizations with ds.search (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/dashboard-studio/10.4/use-data-sources/create-search-based-visualizations-with-ds.search) in the Splunk documentation.