Skip to content
OpenAdvisories
High NCSC-2026-0068 6 CVEs

Kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform

Published Feb 23, 2026 · Updated Feb 23, 2026 · nl

Vendor: Splunk Product: Enterprise

Summary

Splunk heeft kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform.

Details

Interpretaties
De kwetsbaarheden bevinden zich in verschillende versies van Splunk Enterprise en Splunk Cloud Platform. Ze stellen laaggeprivilegieerde gebruikers in staat om beveiligingen te omzeilen, gevoelige informatie te bekijken, en de REST API te misbruiken voor gebruikersauthenticatie. Dit kan leiden tot ongeautoriseerde toegang en verstoring van de service. Specifieke versies van Splunk Enterprise zijn kwetsbaar voor toegang tot de Monitoring Console App endpoints en het inzien van gevoelige configuraties zoals Duo Two-Factor Authentication sleutels, RSA accessKeys, en SAML configuraties in platte tekst. Deze kwetsbaarheden kunnen de integriteit en vertrouwelijkheid van gegevens en authenticatieprocessen in gevaar brengen.

Oplossingen
Splunk heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 6

  • Medium 6.8
    CVE-2026-20138

    Sensitive Information Disclosure in "_internal" index in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the `integrationKey`, `secretKey`, and `appSecretKey`…

    Splunk Splunk Enterprise
  • Medium 6.8
    CVE-2026-20142

    Sensitive Information Disclosure in "_internal" index in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the RSA `accessKey` value from the [<u>Authentication…

    Splunk Splunk Enterprise
  • Medium 6.8
    CVE-2026-20144

    Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with acce…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2026-20139

    Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2026-20141

    Improper Access Control in Splunk Monitoring Console App

    In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin" Splunk role could access the Splunk Monitoring Console App endpoints due to an improper access control. This could lead to a sensitive in…

    Splunk Splunk Enterprise
  • Low 3.5
    CVE-2026-20137

    Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122, a low-privileged user who does not hold the "admin" or "power" Splunk roles could b…

    Splunk Splunk Enterprise Splunk Cloud Platform

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0202
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0203
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0204
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0205
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0206
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0207
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0208
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0209