# CVE-2026-20255: Splunk Enterprise and Cloud Platform data exfiltration in Classic Dashboards

Source: https://junglewise.ai/threats/cve-2026-20255-splunk-enterprise-and-cloud-platform-data-exfiltration-in-classic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-20255 · Severity: medium · CVSS 5.7 · Published 2026-06-10

Splunk Enterprise and Splunk Cloud Platform are data analysis platforms used for monitoring and searching machine-generated data. A vulnerability in the 'classic dashboard' feature allows a low-privileged user to create a malicious dashboard that can steal sensitive information. If another user views this dashboard, their data could be sent to a server controlled by the attacker, potentially leading to the exposure of internal corporate information.

Technologies: [Splunk Cloud Platform](https://junglewise.ai/threats/technologies/cloud-platform). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-20255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20255 being exploited in the wild.

**How severe is CVE-2026-20255?** Medium severity, with a CVSS score of 5.7, published 10 June 2026.

**Which products and versions are affected?** Splunk Cloud Platform Below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132.

**Is there a fix for CVE-2026-20255?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20255 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20255?** Check whether you run Splunk Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability (CWE-20) exists in the Splunk Web component's external content dialog. The root cause is incomplete URL validation, which fails to properly restrict requests to trusted domains. An attacker with low-privileged access can create a malicious classic dashboard that, when interacted with by another user, triggers requests to an untrusted external domain. This can be used to exfiltrate sensitive data. The attack requires network access, low-level authentication, and user interaction. Patches are available in Splunk Enterprise versions 10.4.0, 10.2.4, 10.0.7, 9.4.12, and 9.3.13, as well as various Splunk Cloud Platform updates.

## Affected products

- Splunk Splunk Enterprise Below 10.2.4, 10.0.7, 9.4.12, 9.3.13
- Splunk Splunk Cloud Platform Below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory

## References

- [https://advisory.splunk.com/advisories/SVD-2026-0605](https://advisory.splunk.com/advisories/SVD-2026-0605)

## Related threats

- [Splunk Enterprise and Cloud Platform information disclosure in REST API](https://junglewise.ai/threats/cve-2026-20298-splunk-enterprise-and-cloud-platform-information-disclosure-in)
- [Splunk Enterprise path traversal in App Install REST endpoint](https://junglewise.ai/threats/cve-2026-20297-splunk-enterprise-path-traversal-in-app-install-rest-endpoint)
- [Splunk Enterprise improper access control in saved search ownership](https://junglewise.ai/threats/cve-2026-20259-splunk-enterprise-improper-access-control-in-saved-search)
- [Splunk Enterprise stored XSS in classic dashboard HTML panel](https://junglewise.ai/threats/cve-2026-20258-splunk-enterprise-stored-xss-in-classic-dashboard-html-panel)
- [Splunk Enterprise and Cloud Platform Data Exfiltration in Classic Dashboards](https://junglewise.ai/threats/cve-2026-20257-splunk-enterprise-and-cloud-platform-data-exfiltration-in-classic)