Vulnerability-Lookup

CVE-2026-20256 (GCVE-0-2026-20256)

Vulnerability from cvelistv5 – Published: 2026-06-10 17:15 – Updated: 2026-06-10 18:19

Title

Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise

Summary

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.<br><br>The vulnerability exists because the URL classifier in classic dashboards only recognizes `http://` and `https://` schemes when checking for external URLs. Protocol-relative URLs such as `//attacker.com` bypass this check entirely, and Splunk Web does not show the external-navigation warning dialog to the victim.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 18:18 UTC

CWE

CWE-20 - The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.

Assigner

cisco mitre root

References

1 reference

URL	Tags
https://advisory.splunk.com/advisories/SVD-2026-0606

Impacted products

2 products

Vendor	Product	Version	CPE status
Splunk	Splunk Enterprise	Affected: 10.2 , < 10.2.4 (custom) Affected: 10.0 , < 10.0.7 (custom) Affected: 9.4 , < 9.4.12 (custom) Affected: 9.3 , < 9.3.13 (custom)	guessed
Splunk	Splunk Cloud Platform	Affected: 10.3.2512 , < 10.3.2512.13 (custom) Affected: 10.2.2510 , < 10.2.2510.15 (custom) Affected: 10.1.2507 , < 10.1.2507.23 (custom) Affected: 9.3.2411 , < 9.3.2411.132 (custom)	guessed

Date Public

2026-06-10 00:00

Credits

Tony Tong (tongster)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20256",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T18:18:59.939227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T18:19:26.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "10.2.4",
              "status": "affected",
              "version": "10.2",
              "versionType": "custom"
            },
            {
              "lessThan": "10.0.7",
              "status": "affected",
              "version": "10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "9.4.12",
              "status": "affected",
              "version": "9.4",
              "versionType": "custom"
            },
            {
              "lessThan": "9.3.13",
              "status": "affected",
              "version": "9.3",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "10.3.2512.13",
              "status": "affected",
              "version": "10.3.2512",
              "versionType": "custom"
            },
            {
              "lessThan": "10.2.2510.15",
              "status": "affected",
              "version": "10.2.2510",
              "versionType": "custom"
            },
            {
              "lessThan": "10.1.2507.23",
              "status": "affected",
              "version": "10.1.2507",
              "versionType": "custom"
            },
            {
              "lessThan": "9.3.2411.132",
              "status": "affected",
              "version": "9.3.2411",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tony Tong (tongster)"
        }
      ],
      "datePublic": "2026-06-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.\u003cbr\u003e\u003cbr\u003eThe vulnerability exists because the URL classifier in classic dashboards only recognizes `http://` and `https://` schemes when checking for external URLs. Protocol-relative URLs such as `//attacker.com` bypass this check entirely, and Splunk Web does not show the external-navigation warning dialog to the victim."
            }
          ],
          "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.\u003cbr\u003e\u003cbr\u003eThe vulnerability exists because the URL classifier in classic dashboards only recognizes `http://` and `https://` schemes when checking for external URLs. Protocol-relative URLs such as `//attacker.com` bypass this check entirely, and Splunk Web does not show the external-navigation warning dialog to the victim."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T17:15:55.966Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2026-0606"
        }
      ],
      "source": {
        "advisory": "SVD-2026-0606"
      },
      "title": "Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20256",
    "datePublished": "2026-06-10T17:15:55.966Z",
    "dateReserved": "2025-10-08T11:59:15.401Z",
    "dateUpdated": "2026-06-10T18:19:26.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-20256",
      "date": "2026-09-25",
      "epss": "0.00361",
      "percentile": "0.27225"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Splunk Enterprise",
                "vendor": "Splunk",
                "versions": [
                  {
                    "lessThan": "10.2.4",
                    "status": "affected",
                    "version": "10.2",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "10.0.7",
                    "status": "affected",
                    "version": "10.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "9.4.12",
                    "status": "affected",
                    "version": "9.4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "9.3.13",
                    "status": "affected",
                    "version": "9.3",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "Splunk Cloud Platform",
                "vendor": "Splunk",
                "versions": [
                  {
                    "lessThan": "10.3.2512.13",
                    "status": "affected",
                    "version": "10.3.2512",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "10.2.2510.15",
                    "status": "affected",
                    "version": "10.2.2510",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "10.1.2507.23",
                    "status": "affected",
                    "version": "10.1.2507",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "9.3.2411.132",
                    "status": "affected",
                    "version": "9.3.2411",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "psirt@cisco.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "B9D80F1C-F849-4D62-B82A-6B8963EEEBFB",
                    "versionEndExcluding": "9.3.13",
                    "versionStartIncluding": "9.3.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "423B8DF2-B7A5-41AA-9CFD-75B2FD503ACC",
                    "versionEndExcluding": "9.4.12",
                    "versionStartIncluding": "9.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "0C9F1DED-280E-4C76-A867-A7A8FCBD1F7A",
                    "versionEndExcluding": "10.0.7",
                    "versionStartIncluding": "10.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "E3B992C0-AD5E-43A1-BAA3-6B11FFD5D750",
                    "versionEndExcluding": "10.2.4",
                    "versionStartIncluding": "10.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "88A68C7C-BE2C-465C-812B-8F211A8AE935",
                    "versionEndExcluding": "9.3.2411.132",
                    "versionStartIncluding": "9.3.2411",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "84E3B0CD-9909-4F06-9ABE-763705D501C3",
                    "versionEndExcluding": "10.1.2507.23",
                    "versionStartIncluding": "10.1.2507",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "71B91525-F2D6-4699-8D6B-8D375A8785EE",
                    "versionEndExcluding": "10.2.2510.15",
                    "versionStartIncluding": "10.2.2510",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6387100F-0867-4B83-8071-BA1FCE023B2F",
                    "versionEndExcluding": "10.3.2512.13",
                    "versionStartIncluding": "10.3.2512",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.\u003cbr\u003e\u003cbr\u003eThe vulnerability exists because the URL classifier in classic dashboards only recognizes `http://` and `https://` schemes when checking for external URLs. Protocol-relative URLs such as `//attacker.com` bypass this check entirely, and Splunk Web does not show the external-navigation warning dialog to the victim."
          }
        ],
        "id": "CVE-2026-20256",
        "lastModified": "2026-06-17T10:17:20.563",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.1,
              "impactScore": 3.6,
              "source": "psirt@cisco.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-20256",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T18:18:59.939227Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-10T18:16:41.133",
        "references": [
          {
            "source": "psirt@cisco.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://advisory.splunk.com/advisories/SVD-2026-0606"
          }
        ],
        "sourceIdentifier": "psirt@cisco.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "psirt@cisco.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

CERTFR-2026-AVI-0736

Vulnerability from certfr_avis - Published: 2026-06-11 - Updated: 2026-06-11

De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une falsification de requêtes côté serveur (SSRF).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Splunk	Splunk Secure Gateway	Splunk Secure Gateway versions 3.10.x antérieures à 3.10.6
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 10.1.2507.x antérieures à 10.1.2507.23
Splunk	Splunk Enterprise	Splunk Enterprise versions 9.3.x antérieures à 9.3.13
Splunk	Splunk Enterprise	Splunk Enterprise versions 9.4.x antérieures à 9.4.12
Splunk	SOAR	Splunk SOAR versions antérieures à 8.5.0
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 9.3.2411.x antérieures à 9.3.2411.132
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 10.2.2510.x antérieures à 10.2.2510.15
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 10.3.2512.x antérieures à 10.3.2512.13
Splunk	Splunk Enterprise	Splunk Enterprise versions 10.0.x antérieures à 10.0.7
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 10.4.2604.x antérieures à 10.4.2604.3
Splunk	Splunk Secure Gateway	Splunk Secure Gateway versions antérieures à 3.8.67
Splunk	Splunk Enterprise	Splunk Enterprise versions 10.2.x antérieures à 10.2.4
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 10.0.2503.x antérieures à 10.0.2503.14
Splunk	Splunk Secure Gateway	Splunk Secure Gateway versions 3.9.x antérieures à 3.9.20

References

Title

Publication Time

Tags

Bulletin de sécurité Splunk SVD-2026-0612	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0602	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0610	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0601	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0603	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0608	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0609	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0611	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0606	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0605	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0604	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0607	2026-06-10	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Splunk Secure Gateway versions 3.10.x ant\u00e9rieures \u00e0 3.10.6",
      "product": {
        "name": "Splunk Secure Gateway",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 10.1.2507.x ant\u00e9rieures \u00e0 10.1.2507.23",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 9.3.x ant\u00e9rieures \u00e0 9.3.13",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 9.4.x ant\u00e9rieures \u00e0 9.4.12",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk SOAR versions ant\u00e9rieures \u00e0 8.5.0",
      "product": {
        "name": "SOAR",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 9.3.2411.x ant\u00e9rieures \u00e0 9.3.2411.132",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 10.2.2510.x ant\u00e9rieures \u00e0 10.2.2510.15",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 10.3.2512.x ant\u00e9rieures \u00e0 10.3.2512.13",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 10.0.x ant\u00e9rieures \u00e0 10.0.7",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 10.4.2604.x ant\u00e9rieures \u00e0 10.4.2604.3",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Secure Gateway versions ant\u00e9rieures \u00e0 3.8.67",
      "product": {
        "name": "Splunk Secure Gateway",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 10.2.x ant\u00e9rieures \u00e0 10.2.4",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 10.0.2503.x ant\u00e9rieures \u00e0 10.0.2503.14",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Secure Gateway versions 3.9.x ant\u00e9rieures \u00e0 3.9.20",
      "product": {
        "name": "Splunk Secure Gateway",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-20260",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20260"
    },
    {
      "name": "CVE-2026-22701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22701"
    },
    {
      "name": "CVE-2025-61731",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-61731"
    },
    {
      "name": "CVE-2026-20259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20259"
    },
    {
      "name": "CVE-2026-2006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2006"
    },
    {
      "name": "CVE-2026-2005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2005"
    },
    {
      "name": "CVE-2026-24051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24051"
    },
    {
      "name": "CVE-2026-20256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20256"
    },
    {
      "name": "CVE-2026-20257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20257"
    },
    {
      "name": "CVE-2026-1703",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1703"
    },
    {
      "name": "CVE-2026-27142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27142"
    },
    {
      "name": "CVE-2026-20255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20255"
    },
    {
      "name": "CVE-2026-20258",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20258"
    },
    {
      "name": "CVE-2026-34480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34480"
    },
    {
      "name": "CVE-2025-68161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
    },
    {
      "name": "CVE-2025-61732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-61732"
    },
    {
      "name": "CVE-2025-68146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68146"
    },
    {
      "name": "CVE-2026-25679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
    },
    {
      "name": "CVE-2026-20252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20252"
    },
    {
      "name": "CVE-2026-1229",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1229"
    },
    {
      "name": "CVE-2026-20254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20254"
    },
    {
      "name": "CVE-2025-12818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-12818"
    },
    {
      "name": "CVE-2026-4148",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4148"
    },
    {
      "name": "CVE-2025-8869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8869"
    },
    {
      "name": "CVE-2025-12817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-12817"
    },
    {
      "name": "CVE-2025-47913",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-47913"
    },
    {
      "name": "CVE-2025-58181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-58181"
    },
    {
      "name": "CVE-2026-27459",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
    },
    {
      "name": "CVE-2026-4147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4147"
    },
    {
      "name": "CVE-2025-47914",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-47914"
    },
    {
      "name": "CVE-2026-34516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34516"
    },
    {
      "name": "CVE-2026-27448",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27448"
    },
    {
      "name": "CVE-2026-20251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20251"
    },
    {
      "name": "CVE-2026-23490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23490"
    },
    {
      "name": "CVE-2026-24049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24049"
    },
    {
      "name": "CVE-2026-2003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2003"
    },
    {
      "name": "CVE-2026-4358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4358"
    },
    {
      "name": "CVE-2025-68121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
    },
    {
      "name": "CVE-2026-20253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20253"
    },
    {
      "name": "CVE-2025-61726",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
    },
    {
      "name": "CVE-2026-34520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34520"
    },
    {
      "name": "CVE-2026-2004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2004"
    },
    {
      "name": "CVE-2026-34477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34477"
    }
  ],
  "initial_release_date": "2026-06-11T00:00:00",
  "last_revision_date": "2026-06-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0736",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Splunk. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Splunk",
  "vendor_advisories": [
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0612",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0612"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0602",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0602"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0610",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0610"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0601",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0601"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0603",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0603"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0608",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0608"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0609",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0609"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0611",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0611"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0606",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0606"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0605",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0605"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0604",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0604"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0607",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0607"
    }
  ]
}

FKIE_CVE-2026-20256

Vulnerability from fkie_nvd - Published: 2026-06-10 18:16 - Updated: 2026-06-17 10:17

Severity

5.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	psirt@cisco.com	https://advisory.splunk.com/advisories/SVD-2026-0606	Vendor Advisory

Impacted products

Vendor	Product	Version
splunk	splunk	*
splunk	splunk	*
splunk	splunk	*
splunk	splunk	*
splunk	splunk_cloud_platform	*
splunk	splunk_cloud_platform	*
splunk	splunk_cloud_platform	*
splunk	splunk_cloud_platform	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "10.2.4",
              "status": "affected",
              "version": "10.2",
              "versionType": "custom"
            },
            {
              "lessThan": "10.0.7",
              "status": "affected",
              "version": "10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "9.4.12",
              "status": "affected",
              "version": "9.4",
              "versionType": "custom"
            },
            {
              "lessThan": "9.3.13",
              "status": "affected",
              "version": "9.3",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "10.3.2512.13",
              "status": "affected",
              "version": "10.3.2512",
              "versionType": "custom"
            },
            {
              "lessThan": "10.2.2510.15",
              "status": "affected",
              "version": "10.2.2510",
              "versionType": "custom"
            },
            {
              "lessThan": "10.1.2507.23",
              "status": "affected",
              "version": "10.1.2507",
              "versionType": "custom"
            },
            {
              "lessThan": "9.3.2411.132",
              "status": "affected",
              "version": "9.3.2411",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B9D80F1C-F849-4D62-B82A-6B8963EEEBFB",
              "versionEndExcluding": "9.3.13",
              "versionStartIncluding": "9.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "423B8DF2-B7A5-41AA-9CFD-75B2FD503ACC",
              "versionEndExcluding": "9.4.12",
              "versionStartIncluding": "9.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "0C9F1DED-280E-4C76-A867-A7A8FCBD1F7A",
              "versionEndExcluding": "10.0.7",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "E3B992C0-AD5E-43A1-BAA3-6B11FFD5D750",
              "versionEndExcluding": "10.2.4",
              "versionStartIncluding": "10.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "88A68C7C-BE2C-465C-812B-8F211A8AE935",
              "versionEndExcluding": "9.3.2411.132",
              "versionStartIncluding": "9.3.2411",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "84E3B0CD-9909-4F06-9ABE-763705D501C3",
              "versionEndExcluding": "10.1.2507.23",
              "versionStartIncluding": "10.1.2507",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "71B91525-F2D6-4699-8D6B-8D375A8785EE",
              "versionEndExcluding": "10.2.2510.15",
              "versionStartIncluding": "10.2.2510",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6387100F-0867-4B83-8071-BA1FCE023B2F",
              "versionEndExcluding": "10.3.2512.13",
              "versionStartIncluding": "10.3.2512",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.\u003cbr\u003e\u003cbr\u003eThe vulnerability exists because the URL classifier in classic dashboards only recognizes `http://` and `https://` schemes when checking for external URLs. Protocol-relative URLs such as `//attacker.com` bypass this check entirely, and Splunk Web does not show the external-navigation warning dialog to the victim."
    }
  ],
  "id": "CVE-2026-20256",
  "lastModified": "2026-06-17T10:17:20.563",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-20256",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-10T18:18:59.939227Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-10T18:16:41.133",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0606"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    }
  ]
}

GHSA-P326-4XF8-XP88

Vulnerability from github – Published: 2026-06-10 18:31 – Updated: 2026-06-10 18:31

Details

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.

The vulnerability exists because the URL classifier in classic dashboards only recognizes http:// and https:// schemes when checking for external URLs. Protocol-relative URLs such as //attacker.com bypass this check entirely, and Splunk Web does not show the external-navigation warning dialog to the victim.

Severity

5.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-20256"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-10T18:16:41Z",
    "severity": "MODERATE"
  },
  "details": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could cause data exfiltration through classic dashboards by redirecting a victim to an external site using a protocol-relative URL in a drill-down link.\u003cbr\u003e\u003cbr\u003eThe vulnerability exists because the URL classifier in classic dashboards only recognizes `http://` and `https://` schemes when checking for external URLs. Protocol-relative URLs such as `//attacker.com` bypass this check entirely, and Splunk Web does not show the external-navigation warning dialog to the victim.",
  "id": "GHSA-p326-4xf8-xp88",
  "modified": "2026-06-10T18:31:46Z",
  "published": "2026-06-10T18:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20256"
    },
    {
      "type": "WEB",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0606"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0198

Vulnerability from csaf_ncscnl - Published: 2026-06-15 08:27 - Updated: 2026-06-19 12:42

Summary

Kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform

Scope

9 vulnerabilities in this advisory, including CVE-2026-20256.

CVE-2026-20256

A vulnerability in certain versions of Splunk Enterprise and Splunk Cloud Platform enables low-privileged users to exfiltrate data by exploiting protocol-relative URLs in classic dashboard drill-down links, bypassing URL validation and external navigation warnings.

5.7 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Known affected: 4 products

Open the full advisory

WID-SEC-W-2026-1877

Vulnerability from csaf_certbund - Published: 2026-06-10 22:00 - Updated: 2026-06-14 22:00

Summary

Splunk Enterprise: Mehrere Schwachstellen

Severity

Hoch

Scope

9 vulnerabilities in this advisory, including CVE-2026-20256.

CVE-2026-20256

Known affected: 5 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-20256 (GCVE-0-2026-20256)

CERTFR-2026-AVI-0736

Solutions

FKIE_CVE-2026-20256

GHSA-P326-4XF8-XP88

NCSC-2026-0198

WID-SEC-W-2026-1877

Tags

Sightings

Nomenclature

Related by attack behaviour