← Back

CVE-2026-20255

nvd nist
Published: Jun 10, 2026Modified: Jun 17, 2026

JSON object

Loading...
5.7
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Exploitability: 2.1 / Impact: 3.6
Source: psirt@cisco.com (Secondary)

Description

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious classic dashboard that exfiltrates sensitive data to an external server. The vulnerability exists because URL validation on the external content dialog is incomplete, which can allow for requests to untrusted domains when a user interacts with a crafted dashboard.

Affected (8)

Splunk
2 products
Splunk
Splunk Cloud Platform
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Splunk
Splunk
From 10.0.0 to 10.0.7
Splunk
From 10.2.0 to 10.2.4
Splunk
From 9.3.0 to 9.3.13
Splunk
From 9.4.0 to 9.4.12
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Splunk
Splunk Cloud Platform
From 10.1.2507 to 10.1.2507.23
Splunk Cloud Platform
From 10.2.2510 to 10.2.2510.15
Splunk Cloud Platform
From 10.3.2512 to 10.3.2512.13
Splunk Cloud Platform
From 9.3.2411 to 9.3.2411.132

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (1)

Source: psirt@cisco.com
Vendor Advisory

Timeline

No history available yet.