Home

Description

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious classic dashboard that exfiltrates sensitive data to an external server when a higher-privileged user views it, bypassing the external content restriction through a Cascading Style Sheets (CSS) injection.<br><br>The Trusted Domains security check does not fully validate inline style attribute values, which can allow for outbound requests to untrusted domains and credential exfiltration when a victim views a crafted dashboard.

PUBLISHED Reserved 2025-10-08 | Published 2026-06-10 | Updated 2026-06-10 | Assigner cisco




MEDIUM: 5.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Problem types

The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.

Product status

10.2 (custom) before 10.2.4
affected

10.0 (custom) before 10.0.7
affected

9.4 (custom) before 9.4.12
affected

9.3 (custom) before 9.3.13
affected

10.3.2512 (custom) before 10.3.2512.13
affected

10.2.2510 (custom) before 10.2.2510.15
affected

10.1.2507 (custom) before 10.1.2507.23
affected

9.3.2411 (custom) before 9.3.2411.132
affected

Credits

Fredrik Alexandersson (stok)

References

advisory.splunk.com/advisories/SVD-2026-0604

cve.org (CVE-2026-20254)

nvd.nist.gov (CVE-2026-20254)

Download JSON