# CVE-2026-20254: Splunk Enterprise CSS injection in classic dashboards

Source: https://junglewise.ai/threats/cve-2026-20254-splunk-enterprise-css-injection-in-classic-dashboards  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-20254 · Severity: medium · CVSS 5.7 · Published 2026-06-10

Splunk Enterprise and Splunk Cloud Platform are data analysis platforms used to monitor and search machine-generated data. A vulnerability in the dashboard component allows a low-privileged user to create a malicious dashboard that can steal sensitive information or credentials from higher-privileged users (like administrators) when they view it. This could lead to unauthorized access to sensitive corporate data or administrative accounts.

Technologies: [Splunk Cloud Platform](https://junglewise.ai/threats/technologies/cloud-platform). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-20254 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20254 being exploited in the wild.

**How severe is CVE-2026-20254?** Medium severity, with a CVSS score of 5.7, published 10 June 2026.

**Which products and versions are affected?** Splunk Cloud Platform Below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132.

**Is there a fix for CVE-2026-20254?** A patch was published on 2026-06-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20254 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20254?** Check whether you run Splunk Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CSS injection vulnerability exists in Splunk Web's classic dashboards due to improper input validation in the 'Trusted Domains' security check. The component fails to fully validate inline style attribute values, allowing an attacker with low-level permissions to inject malicious CSS. When a victim with higher privileges (such as an 'admin' or 'power' user) views the crafted dashboard, the injected CSS can trigger outbound requests to untrusted domains, leading to credential exfiltration or sensitive data disclosure. This bypasses existing external content restrictions. Patches are available in Splunk Enterprise versions 10.4.0, 10.2.4, 10.0.7, 9.4.12, and 9.3.13.

## Affected products

- Splunk Splunk Enterprise Below 10.2.4, 10.0.7, 9.4.12, 9.3.13
- Splunk Splunk Cloud Platform Below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-06-10: patched

## References

- [https://advisory.splunk.com/advisories/SVD-2026-0604](https://advisory.splunk.com/advisories/SVD-2026-0604)

## Related threats

- [Splunk Enterprise and Cloud Platform information disclosure in REST API](https://junglewise.ai/threats/cve-2026-20298-splunk-enterprise-and-cloud-platform-information-disclosure-in)
- [Splunk Enterprise path traversal in App Install REST endpoint](https://junglewise.ai/threats/cve-2026-20297-splunk-enterprise-path-traversal-in-app-install-rest-endpoint)
- [Splunk Enterprise improper access control in saved search ownership](https://junglewise.ai/threats/cve-2026-20259-splunk-enterprise-improper-access-control-in-saved-search)
- [Splunk Enterprise stored XSS in classic dashboard HTML panel](https://junglewise.ai/threats/cve-2026-20258-splunk-enterprise-stored-xss-in-classic-dashboard-html-panel)
- [Splunk Enterprise and Cloud Platform Data Exfiltration in Classic Dashboards](https://junglewise.ai/threats/cve-2026-20257-splunk-enterprise-and-cloud-platform-data-exfiltration-in-classic)