CVE-2026-20254: Splunk CSS Injection Enables Credential Exfiltration via Malicious Dashboards

Technical summary

CVE-2026-20254 is a CSS injection vulnerability in Splunk's dashboard functionality that circumvents the Trusted Domains security check. The flaw exists in how inline style attribute values are validated; specifically, attackers can inject CSS properties that trigger outbound HTTP requests to external, untrusted domains. When a user with elevated privileges (admin or power role) views the malicious classic dashboard, the injected CSS executes in their security context, enabling data exfiltration. The vulnerability affects Splunk Enterprise versions before 10.2.4, 10.0.7, 9.4.12, and 9.3.13, as well as Splunk Cloud Platform versions before 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132.

Business impact

This vulnerability creates a privilege escalation and data exfiltration risk. Attackers with basic Splunk access can compromise higher-privileged accounts and extract sensitive data—potentially including authentication tokens, configuration secrets, and business intelligence stored within Splunk. Organizations that share dashboard libraries or permit user-generated dashboards face heightened risk, as a single malicious dashboard could be viewed by multiple administrators, multiplying the exposure. The attack requires no advanced technical knowledge and leaves minimal audit trails if not actively monitored.

Affected systems

Splunk Enterprise versions: below 10.2.4, 10.0.7, 9.4.12, and 9.3.13. Splunk Cloud Platform versions: below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132. Any organization running these versions with classic dashboards and dashboard-sharing workflows is vulnerable. Cloud-based Splunk deployments may be patched automatically by Splunk; on-premises Enterprise customers must manually apply updates.

Exploitability

Exploitability is straightforward. An attacker needs only basic Splunk user access (no admin role required) and the ability to create or modify a classic dashboard—a common feature in Splunk environments. The attack is triggered passively when a victim with higher privileges simply views the dashboard; no additional user interaction beyond normal dashboard viewing is required. There is no public exploit code reported, but the attack surface is broad in organizations where dashboard creation is delegated to multiple users. The CVSS score of 5.7 (MEDIUM) reflects that while impact is high (credential/data exfiltration), exploitation requires a low-privilege user account and relies on social engineering (convincing an admin to view the dashboard).

Remediation

Update affected Splunk instances immediately to patched versions. For Splunk Enterprise, upgrade to version 10.2.4, 10.0.7, 9.4.12, or 9.3.13 or later (depending on your current version branch). For Splunk Cloud Platform, ensure you are running 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132 or later. Cloud customers should verify patching status with Splunk's dashboard or support. As an interim mitigation, restrict dashboard creation and editing permissions to trusted administrators only, and educate users not to open dashboards from untrusted sources. Monitor outbound connections from your Splunk infrastructure for unexpected external domain requests.

Patch guidance

Splunk has released patches for all affected versions. On-premises Enterprise customers should prioritize upgrades in this order: 1) Production instances running 9.3.x, 9.4.x, 10.0.x, or 10.2.x; 2) Non-production instances; 3) Lab/dev environments. Test patches in a non-production environment before deployment to ensure compatibility with custom apps and dashboards. Splunk Cloud customers should verify patch status through their cloud console—Splunk may apply updates automatically, but confirmation is recommended. No rollback complications are expected; patches are backward-compatible.

Detection guidance

Audit the Splunk audit logs for dashboard creation or modification events by low-privileged users, particularly any changes to classic dashboards. Search for CSS-related changes in dashboard XML (look for inline 'style' attributes with unusual property values). Monitor HTTP access logs and firewall egress logs for outbound connections from Splunk instances to unexpected external domains, especially over ports 80/443 with suspicious User-Agent strings or timing patterns. Enable Splunk's data lineage and access logging features to track which dashboards were viewed and by whom. Set up alerts on any new external domain lookups initiated from the Splunk search head or indexer tier.

Why prioritize this

Although CVSS assigns this a MEDIUM score, context elevates urgency: (1) The attack is trivial to execute and requires only basic user access; (2) It directly targets high-value victims (admins/power users) who can access sensitive data and configurations; (3) Credential exfiltration has cascading risk across your infrastructure; (4) The attack is hard to detect without active monitoring. Organizations with shared dashboards, SOC teams, or multi-tenant Splunk deployments should treat this as HIGH priority. Patch within 30 days for most environments; within 7–14 days if dashboards are frequently shared across user groups.

Risk score, explained

The CVSS 3.1 score of 5.7 reflects a Medium severity. The vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) indicates network attack vector, low complexity, low privilege requirements, required user interaction (victim viewing the dashboard), no scope change, high confidentiality impact (data exfiltration), no integrity or availability impact. The score undershoots actual organizational risk because it does not account for the downstream value of compromised admin credentials or the likelihood that Splunk holds business-critical data. Adjust internal risk ratings upward if Splunk is used for security monitoring, compliance, or secrets storage.

Frequently asked questions