Back to overview

CVE-2026-20254

MEDIUM
5.7
CVSS 3.1
Description
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious classic dashboard that exfiltrates sensitive data to an external server when a higher-privileged user views it, bypassing the external content restriction through a Cascading Style Sheets (CSS) injection.<br><br>The Trusted Domains security check does not fully validate inline style attribute values, which can allow for outbound requests to untrusted domains and credential exfiltration when a victim views a crafted dashboard.

Metadata

CVE ID
CVE-2026-20254
State
PUBLISHED
Assigner
cisco
Reserved
2025-10-08 11:59 UTC
Published
2026-06-10 17:15 UTC
Last updated
2026-06-10 18:27 UTC
Primary CWE
CWE-20
The product does not validate or incorrectly validates input…
Vendor / Product
Splunk / Splunk Enterprise
Sources
cve.org  ·  NVD

Severity & Metrics

5.7 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (2)
VendorProductPlatformVersions
Splunk Splunk Cloud Platform — 10.3.2512 < 10.3.2512.13, 10.2.2510 < 10.2.2510.15, 10.1.2507 < 10.1.2507.23, 9.3.2411 < 9.3.2411.132
Splunk Splunk Enterprise — 10.2 < 10.2.4, 10.0 < 10.0.7, 9.4 < 9.4.12, 9.3 < 9.3.13
Weakness (CWE)
CWESourceDescription
CWE-20 cna The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.7 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
References (1)
Back to overview