CVE-2026-20257: Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise

Q: What is the severity of CVE-2026-20257?

The severity of CVE-2026-20257 is classified as medium, with a score of 5.7.

Q: How can I fix CVE-2026-20257?

To fix CVE-2026-20257, upgrade to Splunk Enterprise versions 10.2.4, 10.0.7, 9.4.12, or 9.3.13, or to the specified versions of Splunk Cloud Platform.

Q: What type of vulnerability is CVE-2026-20257?

CVE-2026-20257 is categorized as an improper input validation vulnerability.

Q: Who is affected by CVE-2026-20257?

CVE-2026-20257 affects low-privileged users in Splunk who do not hold the 'admin' or 'power' roles.

Q: What can a low-privileged user do with CVE-2026-20257?

A low-privileged user can craft a classic dashboard that exfiltrates sensitive information due to this vulnerability.

Published Jun 10, 2026

Updated

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a classic dashboard that exfiltrates sensitive data from the browser of a higher-privileged user who views it.

The exfiltration is possible because classic dashboard panels do not fully validate style attribute values, which can allow for requests to reach external domains outside the configured Trusted Domains List.

The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.

Affected Software

10 affected components

Splunk Splunk Enterprise<10.2.4, <10.0.7, <9.4.12, <9.3.13

Splunk Splunk Cloud Platform<10.3.2512.13, <10.2.2510.15, <10.1.2507.23, <9.3.2411.132

Splunk splunk>=9.3.0<9.3.13

Splunk splunk>=9.4.0<9.4.12

Splunk splunk>=10.0.0<10.0.7

Splunk splunk>=10.2.0<10.2.4

Splunk Splunk Cloud Platform>=9.3.2411<9.3.2411.132

Splunk Splunk Cloud Platform>=10.1.2507<10.1.2507.23

Splunk Splunk Cloud Platform>=10.2.2510<10.2.2510.15

Splunk Splunk Cloud Platform>=10.3.2512<10.3.2512.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.2.4
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 10.0.7
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 9.4.12
Upgrade
Upgrade Splunk Enterprise to a version that resolves this vulnerability.
Fixed in 9.3.13
Upgrade
Upgrade Splunk Cloud Platform to a version that resolves this vulnerability.
Fixed in 10.3.2512.13
Upgrade
Upgrade Splunk Cloud Platform to a version that resolves this vulnerability.
Fixed in 10.2.2510.15
Upgrade
Upgrade Splunk Cloud Platform to a version that resolves this vulnerability.
Fixed in 10.1.2507.23
Upgrade
Upgrade Splunk Cloud Platform to a version that resolves this vulnerability.
Fixed in 9.3.2411.132

Event History

Jun 10, 2026

CVE Published

via MITRE·05:16 PM

Data Sourced

via MITRE·05:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-20257?

The severity of CVE-2026-20257 is classified as medium, with a score of 5.7.

How can I fix CVE-2026-20257?

To fix CVE-2026-20257, upgrade to Splunk Enterprise versions 10.2.4, 10.0.7, 9.4.12, or 9.3.13, or to the specified versions of Splunk Cloud Platform.

What type of vulnerability is CVE-2026-20257?

CVE-2026-20257 is categorized as an improper input validation vulnerability.

Who is affected by CVE-2026-20257?