dbcve.org
SplunkApplication

CVE-2026-20258

MEDIUM · 5.4 CVSS v3.1 Published 2026-06-10
Fix available
A fix is available. Upgrade to 9.3.13 / 9.3.2411.132 or later.
See remediation →
58/100
Remediation priority · Elevated
Remotely reachable

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A stored cross-site scripting (XSS) vulnerability in Splunk Enterprise and Cloud Platform allows low-privileged users to inject malicious JavaScript into classic dashboard HTML panels. When other users view the affected dashboard, the script executes in their browser, enabling session hijacking or data exfiltration.

MitigationUpgrade Splunk Enterprise to versions 10.2.4, 10.0.7, 9.4.12, or 9.3.13 or later, and upgrade Splunk Cloud Platform to 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132 or later. As a compensating control, restrict low-privileged users from creating or editing classic dashboard HTML panels.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
SplunkApplication
Affected:>= 9.3.0, < 9.3.13>= 9.4.0, < 9.4.12>= 10.0.0, < 10.0.7>= 10.2.0, < 10.2.4
Splunk Cloud PlatformApplication
Affected:>= 9.3.2411, < 9.3.2411.132>= 10.1.2507, < 10.1.2507.23>= 10.2.2510, < 10.2.2510.15>= 10.3.2512, < 10.3.2512.11

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check your Splunk Enterprise version
    Log into Splunk Web, go to Settings > About > Version, or access the REST endpoint /services/server/info, or run 'splunk --version' from the command line
    Affected if The installed version falls within any of these ranges: 9.3.0 to 9.3.12, 9.4.0 to 9.4.11, 10.0.0 to 10.0.6, or 10.2.0 to 10.2.3
  2. Check your Splunk Cloud Platform version
    In Splunk Cloud, navigate to the Cloud Platform information page or check the version indicator in the welcome banner
    Affected if The installed version falls within any of these ranges: 9.3.2411 to 9.3.2411.131, 10.1.2507 to 10.1.2507.22, 10.2.2510 to 10.2.2510.14, or 10.3.2512 to 10.3.2512.10
  3. Identify classic dashboard HTML panels in use
    Use the Splunk REST API to search for dashboards with HTML panels: search for 'dashboard' in the savedsearches collection or examine XML dashboard files in $SPLUNK_HOME/etc/users/ for <panel> elements containing HTML tags
    Affected if Classic dashboard HTML panels exist in your environment and low-privileged users have access to view them
  4. Review user roles with dashboard creation permissions
    Go to Settings > Users and Roles and examine roles assigned to users. Check if any roles with 'dashboard' or 'html' create/edit capabilities are assigned to low-privileged users (non-admin roles)
    Affected if Low-privileged users have roles allowing them to create or edit classic dashboard HTML panels
  5. Inspect existing dashboards for suspicious HTML content
    Review classic dashboards containing HTML panels for unexpected script tags, event handlers, or external resource references. Use the Search app to query: | rest /servicesNS/-/search/saved/searches | where searchlike('%<html>%')
    Affected if Any classic dashboard HTML panels contain JavaScript code, event handlers (onload, onclick), or suspicious markup that could execute in other users' browsers

You are affected if your Splunk version is within the affected ranges AND classic dashboard HTML panels exist with low-privileged users having create, edit, or view access.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 9.3.13 / 9.3.2411.132 / 9.4.12 or later
Fixed in 9.3.139.3.2411.1329.4.12
Interim mitigation

Upgrade Splunk Enterprise to versions 10.2.4, 10.0.7, 9.4.12, or 9.3.13 or later, and upgrade Splunk Cloud Platform to 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132 or later. As a compensating control, restrict low-privileged users from creating or editing classic dashboard HTML panels.

Recommended fix High confidence

Splunk Enterprise: upgrade to 9.3.13, 9.4.12, 10.0.7, or 10.2.4 (depending on your branch); Splunk Cloud Platform: upgrade to 9.3.2411.132, 10.1.2507.23, 10.2.2510.15, or 10.3.2512.11 (depending on your version)

  1. 1. Identify your current Splunk Enterprise or Splunk Cloud Platform version using the Splunk web interface (Settings > Server settings > Server information) or via CLI: `splunk --version`
  2. 2. For Splunk Enterprise: Determine which version branch you are on (9.3.x, 9.4.x, 10.0.x, or 10.2.x) to select the appropriate upgrade path
  3. 3. For Splunk Cloud Platform: Contact Splunk Support or your Cloud Administrator to verify your exact version and schedule the upgrade
  4. 4. Review Splunk upgrade documentation and perform a backup of your Splunk environment including configuration files and apps
  5. 5. For Splunk Enterprise: Download the appropriate fixed version from splunk.com (9.3.13, 9.4.12, 10.0.7, or 10.2.4)
  6. 6. For Splunk Enterprise: Stop the Splunk service using `./splunk stop`
  7. 7. For Splunk Enterprise: Install the upgrade following standard Splunk upgrade procedures
  8. 8. Start the Splunk service using `./splunk start`
Caveat Standard Splunk upgrade considerations apply - review Splunk upgrade documentation for potential impacts to custom apps, configurations, and compatibility with existing integrations

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Splunk Scoped from the published advisory
  • Consultation4.0 h
  • Implementation6.0 h
  • Testing8.0 h
  • Review / QA2.0 h
20.0 hours of engineering $3,440
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,504.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-20258 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-20258 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data