Status: UPDATED
| Advisory ID: CVE-2026-20296
Key Details
| CVE | CVE-2026-20296 |
| CVSS Score / Version | 8.3 (High) / CVSS v3.1 |
| Updated | 2026-07-24 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is required; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is low. |
| Affected products | Splunk splunk and Splunk splunk_cloud_platform |
| Classified as | CWE-352 (Cross-Site Request Forgery (CSRF)) |
Affected Products, Subsystems & Sectors
| Subsystems | General OT |
| Sectors | Multiple |
What to Know
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for access to stored credentials and indexed data.<br><br>The vulnerability is possible because Deployment Server endpoints in Splunk Web do not validate Cross-Site Request Forgery (CSRF) tokens on GET requests, and caller-supplied input is not correctly neutralized before it is placed into an SPL search.
What to Do
Monitor Splunk's web page for any future patch releases. See vendor advisory link below.
References