A low‑privileged user that does not possess the admin or power roles can abuse a classic dashboard drill‑down link that contains a protocol‑relative URL (e.g., //attacker.com). The dashboard engine only validates http:// and https:// schemes; the protocol‑relative form bypasses this check, and Splunk Web does not show the external‑navigation warning dialog. When a victim clicks the link, the browser is redirected to the attacker’s site without the user’s knowledge, allowing the attacker to exfiltrate data or perform social‑engineering attacks. This flaw is a classic input‑validation error (CWE‑20).

Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132 are affected. The vulnerability is present only in classic dashboard components of these products.

The CVSS score of 5.7 indicates moderate severity. EPSS is not reported, so the current probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered by any user that can create or modify a dashboard, the risk is significant in environments where dashboards are exposed to many users. An attacker would need only to add a malicious protocol‑relative link and lure a user to click it; no elevated privileges are required.