CVE-2026-76328
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A user with the "power" role can store attacker-controlled SPL in a dashboard. When another authenticated user exports the dashboard as a PDF, Splunk Enterprise runs the injected SPL with that user's permissions, potentially allowing access or modification of data. The vulnerability is due to insufficient validation of dashboard content before processing PDF exports.
Risk Assessment
An attacker could exploit this to gain unauthorized access or modify data within the victim's permissions, potentially compromising data confidentiality and integrity.
Recommendation
Upgrade Splunk Enterprise to version 10.4.1, 10.2.6, 10.0.9, or 9.4.14 or later to remediate the vulnerability.
Original NVD description (English source)
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language (SPL) in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format (PDF) file, Splunk Enterprise runs the injected SPL using the permissions of that user. The injected SPL could access or modify data available to that user. The vulnerability is possible because Splunk Web does not sufficiently validate dashboard content before processing PDF exports. The vulnerability requires the attacker to phish the affected user by tricking them into initiating a request within their browser. The user who holds the "power" Splunk role should not be able to exploit the vulnerability at will. For more information see Generate PDFs of your reports and dashboards (https://help.splunk.com/en/splunk-enterprise/create-dashboards-and-reports/reporting-manual/9.4/report-management/generate-pdfs-of-your-reports-and-dashboards) in the Splunk documentation.