CVE-2026-20257: Splunk Enterprise and Cloud Platform Data Exfiltration in Classic Dashboards

CVE-2026-20257 · Severity: medium · CVSS 5.7 · Published 2026-06-10

A vulnerability in Splunk's classic dashboard system allows a low-privileged user to steal sensitive information from higher-privileged users, such as administrators. By creating a specially crafted dashboard, an attacker can trick a victim's web browser into sending data to an unauthorized external server. This could lead to the exposure of internal data or administrative session details if a high-level user is persuaded to view the malicious dashboard.

Technologies: Splunk Cloud Platform. Vendors: Splunk.

Quick answers

Is CVE-2026-20257 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20257 being exploited in the wild.
How severe is CVE-2026-20257?
Medium severity, with a CVSS score of 5.7, published 10 June 2026.
Which products and versions are affected?
Splunk Cloud Platform Below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132.
Is there a fix for CVE-2026-20257?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20257 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20257?
Check whether you run Splunk Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper input validation vulnerability exists in Splunk Web's classic dashboard panels. The component fails to fully validate CSS style attribute values, allowing an attacker to bypass the configured Trusted Domains List. A low-privileged attacker can craft a dashboard containing malicious style attributes that trigger outbound requests to an attacker-controlled domain when viewed by a victim. Exploitation requires the attacker to have basic user permissions and necessitates user interaction (phishing) to entice a high-privileged user to view the dashboard. Successful exploitation results in the exfiltration of sensitive data from the victim's browser context. Patches are available in Splunk Enterprise versions 10.2.4, 10.0.7, 9.4.12, 9.3.13, and 10.4.0.

Affected products

  • Splunk Splunk Enterprise Below 10.2.4, 10.0.7, 9.4.12, 9.3.13
  • Splunk Splunk Cloud Platform Below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, 9.3.2411.132

Timeline

  • 2026-06-10: disclosed
  • 2026-06-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.