# CVE-2026-20256: Splunk Enterprise and Cloud Platform data exfiltration in Classic Dashboards

Source: https://junglewise.ai/threats/cve-2026-20256-splunk-enterprise-and-cloud-platform-data-exfiltration-in-classic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-20256 · Severity: medium · CVSS 5.7 · Published 2026-06-10

A vulnerability in Splunk's classic dashboards allows low-privileged users to create malicious links that redirect other users to external websites without warning. This could be used to trick victims into visiting attacker-controlled sites, potentially leading to the theft of sensitive information or data exfiltration. The issue affects both self-hosted Splunk Enterprise and Splunk Cloud Platform environments.

Technologies: [Splunk Cloud Platform](https://junglewise.ai/threats/technologies/cloud-platform). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-20256 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20256 being exploited in the wild.

**How severe is CVE-2026-20256?** Medium severity, with a CVSS score of 5.7, published 10 June 2026.

**Which products and versions are affected?** Splunk Cloud Platform < 10.3.2512.13, < 10.2.2510.15, < 10.1.2507.23, < 9.3.2411.132.

**Is there a fix for CVE-2026-20256?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20256 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20256?** Check whether you run Splunk Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability (CWE-20) exists in the Splunk Web component's URL classifier for classic dashboards. The classifier only validates 'http://' and 'https://' schemes, failing to recognize protocol-relative URLs (e.g., '//attacker.com'). A low-privileged authenticated attacker can exploit this by embedding these URLs in dashboard drill-down links. When a victim clicks the link, Splunk fails to display the standard external-navigation warning dialog, facilitating stealthy redirection to an external domain. This can be used for data exfiltration or phishing. Fixes are available in Splunk Enterprise versions 10.2.4, 10.0.7, 9.4.12, 9.3.13, and 10.4.0.

## Affected products

- Splunk Splunk Enterprise < 10.2.4, < 10.0.7, < 9.4.12, < 9.3.13
- Splunk Splunk Cloud Platform < 10.3.2512.13, < 10.2.2510.15, < 10.1.2507.23, < 9.3.2411.132

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory

## References

- [https://advisory.splunk.com/advisories/SVD-2026-0606](https://advisory.splunk.com/advisories/SVD-2026-0606)

## Related threats

- [Splunk Enterprise and Cloud Platform information disclosure in REST API](https://junglewise.ai/threats/cve-2026-20298-splunk-enterprise-and-cloud-platform-information-disclosure-in)
- [Splunk Enterprise path traversal in App Install REST endpoint](https://junglewise.ai/threats/cve-2026-20297-splunk-enterprise-path-traversal-in-app-install-rest-endpoint)
- [Splunk Enterprise improper access control in saved search ownership](https://junglewise.ai/threats/cve-2026-20259-splunk-enterprise-improper-access-control-in-saved-search)
- [Splunk Enterprise stored XSS in classic dashboard HTML panel](https://junglewise.ai/threats/cve-2026-20258-splunk-enterprise-stored-xss-in-classic-dashboard-html-panel)
- [Splunk Enterprise and Cloud Platform Data Exfiltration in Classic Dashboards](https://junglewise.ai/threats/cve-2026-20257-splunk-enterprise-and-cloud-platform-data-exfiltration-in-classic)