Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise

Advisory ID: SVD-2026-0606

CVE ID: CVE-2026-20256

Published: 2026-06-10

Last Update: 2026-06-10

CVSSv3.1 Score: 5.7, Medium

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE: CWE-20

Bug ID: VULN-62655

Description

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.

The vulnerability exists because the URL classifier in classic dashboards only recognizes http:// and https:// schemes when checking for external URLs. Protocol-relative URLs such as //attacker.com bypass this check entirely, and Splunk Web does not show the external-navigation warning dialog to the victim.

See Classic Dashboards Trusted Domains List and About role-based user access in the Splunk documentation.

Solution

Upgrade Splunk Enterprise to versions 10.4.0, 10.2.4, 10.0.7, 9.4.12, and 9.3.13, or higher.

Splunk is actively monitoring and patching Splunk Cloud Platform instances.

Product Status

ProductBase VersionComponentAffected VersionFix Version
Splunk Enterprise10.4Splunk WebNot affected10.4.0
Splunk Enterprise10.2Splunk Web10.2.0 to 10.2.310.2.4
Splunk Enterprise10.0Splunk Web10.0.0 to 10.0.610.0.7
Splunk Enterprise9.4Splunk Web9.4.0 to 9.4.119.4.12
Splunk Enterprise9.3Splunk Web9.3.0 to 9.3.129.3.13
Splunk Cloud Platform10.3.2512Splunk WebBelow 10.3.2512.1310.3.2512.13
Splunk Cloud Platform10.2.2510Splunk WebBelow 10.2.2510.1510.2.2510.15
Splunk Cloud Platform10.1.2507Splunk WebBelow 10.1.2507.2310.1.2507.23
Splunk Cloud Platform9.3.2411Splunk WebBelow 9.3.2411.1329.3.2411.132

Mitigations and Workarounds

Configure the Dashboards Trusted Domains List to restrict which external domains dashboards can load content from. See Classic Dashboards Trusted Domains List in the Splunk documentation.

Review and restrict which roles have permission to create and edit classic dashboards. See About role-based user access in the Splunk documentation.

Detections

None

Severity

Splunk rates this vulnerability a 5.7, Medium, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N.

Acknowledgments

Tony Tong (tongster)