CVE-2026-76325

This CVE exposes a flaw in how Splunk's architecture treats content execution. The core issue isn't simply stored XSS — it's that Splunk built a system where a user with 'power' role (a role Splunk explicitly distinguished from full admin) can inject JavaScript that executes in sessions belonging to other users, potentially including administrators. The injected code inherits whatever permissions the victim holds in their current session. This is session inheritance, not just cross-site scripting. The vulnerability lives in Splunk's knowledge object model. Tours, dashboards, and similar UI extensions are stored as knowledge objects that resolve from app namespace without content-type validation. The auto-tour feature automatically discovers and renders these objects in any user's browser. Splunk's own documentation referred to this as 'untrusted tour content' — a phrase that reveals someone inside Splunk acknowledged the content wasn't validated, yet it was rendered automatically in user sessions. This reflects a deeper architectural problem: Splunk classified knowledge objects as 'data' (governed by access controls) rather than 'UI code' (requiring execution controls). Their entire RBAC model was designed for data access — what users can read and write — not for controlling what executes in a browser context. The 'power' role creates a meaningful boundary for data access but provides zero protection against execution boundary violations. A power user can inject content that compromises admin sessions they themselves cannot directly access. The CVSS 7.3 score misleads on severity. Splunk environments aggregate authentication tokens, hold credentials for downstream integrations, and are accessed by users with elevated permissions. The blast radius isn't 'arbitrary JavaScript in one browser' — it's arbitrary JavaScript in whatever session belongs to your victim. That context matters far more than the technical exploit complexity suggests. The practical question for defenders: audit which users hold the power role, review knowledge objects in shared apps for unexpected script tags or event handlers, and consider disabling auto-tour discovery in high-security environments until patched. The patch addresses render-time execution, but the deeper question — whether 'share at app level' should mean 'execute in every user's browser' — remains an architectural decision Splunk's threat model never properly answered.

Reviewed through automated stages and approved by a human before publication.