CVE-2026-76326: Stored Cross-Site Scripting through Dashboard Sparkline Tooltip Options in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all relevant data and system integrity available to that user. The vulnerability is possible because the dashboard table renderer does not sufficiently restrict tooltip options or escape tooltip content before display.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any user who opens an attacker-controlled stored dashboard view and hovers over a sparkline table cell can be affected. The JavaScript executes with access to the relevant data and system integrity available to that viewing user.
What access does an attacker need?
The attacker needs a Splunk account that lacks the "admin" and "power" roles and the ability to store a dashboard view. Exploitation also requires another user to open that view and hover over a sparkline table cell.
Which releases are affected?
Affected versions are Splunk Enterprise releases below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The provided information does not identify a configuration-based exception.