This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Splunk fixes 3 vulnerabilities

Splunk fixes 3 vulnerabilities in 2 products [1][2][3][4]. Individual products and their fixed versions: Splunk Enterprise - 10.4.1, 10.2.5, 10.0.8, 9.4.13, 9.3.14 [2][3][4] Splunk Cloud Platform - 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, 10.1.2507.24 [2][3][4]

Splunk Enterprise, Cloud Platform - CSRF (CVE-2026-20296)
CVSS 8.3 (High)

An unauthenticated remote attacker can use a CSRF attack to force an authorized user to run a malicious search on their behalf, thereby gaining access to stored credentials and data [2].

The vulnerability is present in products:

  • Splunk Enterprise; >=10.4.0, <10.4.1; >=10.2.0, <10.2.5; >=10.0.0, <10.0.8; >=9.4.0, <9.4.13
  • Splunk Cloud Platform; <10.5.2605.0; >=10.4.2604.0, <10.4.2604.7; >=10.3.2512.0, <10.3.2512.16; >=10.2.2510.0, <10.2.2510.18; >=10.1.2507.0, <10.1.2507.24

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

More information:

The vulnerability was publicly disclosed 15. 7. 2026.

Splunk Enterprise, Cloud Platform - path traversal (CVE-2026-20297)
CVSS 7.2 (High)

An authenticated remote attacker with permission to manage applications can write files outside the designated directory due to insufficient restriction of the target path during installation [6].

The vulnerability is present in products:

  • Splunk Enterprise; >=10.4.0, <10.4.1; >=10.2.0, <10.2.5; >=10.0.0, <10.0.8; >=9.4.0, <9.4.13; >=9.3.0, <9.3.14
  • Splunk Cloud Platform; <10.5.2605.0; >=10.4.2604.0, <10.4.2604.6; >=10.2.2510.0, <10.2.2510.18; >=10.1.2507.0, <10.1.2507.24

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-20297 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 15. 7. 2026.

Splunk Enterprise, Cloud Platform - sensitive information disclosure (CVE-2026-20298)
CVSS 5.3 (Medium)

An authenticated remote attacker with low privileges can view stored credential hashes due to insufficient access restriction on the storage/passwords endpoint [4].

The vulnerability is present in products:

  • Splunk Enterprise; >=10.4.0, <10.4.1; >=10.2.0, <10.2.5; >=10.0.0, <10.0.8; >=9.4.0, <9.4.13
  • Splunk Cloud Platform; <10.5.2605.0; >=10.4.2604.0, <10.4.2604.6; >=10.3.2512.0, <10.3.2512.15; >=10.2.2510.0, <10.2.2510.18; >=10.1.2507.0, <10.1.2507.24

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 15. 7. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 16. 7. 2026.

CESNET, z.s.p.o. Logo