CVE-2026-76324

This CVE exposes a stored XSS in Splunk's tour feature where insufficient output encoding on navigation links and selector values allows power role users to inject malicious markup that executes in other users' browser contexts. The vulnerability requires a victim to click a crafted link—a social engineering dependency that the CVSS of 5.4 significantly underweights. In Splunk deployments, power role users are typically SOC analysts and incident responders with access to the organization's most sensitive operational data. This isn't a commodity stored XSS; it's a session pivot that lets an attacker execute JavaScript in a browser authenticated to a SIEM containing raw logs, search history, and potentially API keys or SAML assertions cached in session storage. The deeper issue is architectural: Splunk's tour system was designed as a single trust domain where content creation and rendering lived at the same privilege level. User-generated tours that execute in other users' sessions should have been treated as stored XSS payloads by default, with rendering sandboxed or scoped to the creator's session only. Historical patterns in comparable enterprise software (Confluence macros, Zendesk guided setup) suggest the fix is likely a surgical encoding pass on the specific injection point rather than a rendering pipeline refactor—the economic pressure to ship quickly ensures architectural gaps rarely get addressed comprehensively. Prioritize remediation: patch immediately, but also audit Splunk Web for other "collaboration features" from the 2012-2016 era that may have the same trust boundary failure. Features designed for extensibility without security boundaries don't disappear—they become dormant attack surface waiting for the next analyst who digs into forgotten UX layers. The right question isn't whether this specific bug is fixed, but whether Splunk's security development lifecycle treats content rendering to other users' browsers as a security boundary requiring threat modeling. Based on this pattern's history, assume the answer is no and audit proactively.

Reviewed through automated stages and approved by a human before publication.