CVE-2026-20258: Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise

Synopsis

Stored cross-site scripting (XSS) in the Classic Dashboard HTML panel feature of Splunk Enterprise and Splunk Cloud Platform allows a low-privileged authenticated attacker to inject malicious JavaScript into a dashboard, delivered over the network. The attacker must trick a victim user into initiating a browser request that triggers the stored script, requiring a phishing step. Successful exploitation gives the attacker full read, write, and availability impact within the victim's browser session. Patched-image rebuilds at versions 9.3.13, 9.3.2411.132, 9.4.12, 10.0.7, and 10.1.2507.23 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Splunk web interface over the network to inject the malicious script into the dashboard HTML panel.

• AuthenticationRequired

  Any low-privilege Splunk account is sufficient; the attacker does not need admin or power role credentials.

• Victim interactionRequired

  The attacker must phish the victim, tricking them into initiating a browser request that executes the stored script; exploitation cannot be triggered at will.

• Attack complexityDetail

  Attack complexity is high, reflecting that the attacker must coordinate a social-engineering step and cannot reliably trigger execution without victim cooperation.

Blast Radius

• Reads session tokens, credentials, or sensitive search data visible within the victim's authenticated Splunk browser session.
• Modifies dashboard content or Splunk configurations by issuing requests as the victim user.
• Performs actions inside Splunk on behalf of the victim, potentially exfiltrating search results or altering saved searches.
• Disrupts the victim's Splunk session or browser state, degrading their ability to use the platform.