Skip to content
OpenAdvisories

Vendor

Splunk

347 known vulnerabilities.

Products

Splunk Enterprise 259 Splunk Cloud Platform 89 Splunk SOAR 31 Splunk Secure Gateway 20 Splunk AI Toolkit 12 Splunk Cloud 11 Splunk Enterprise Cloud 5 Splunk Connect for Kafka 4 Splunk Light 4 Splunk Add-on Builder 3 AD LDAP app for Splunk SOAR 3 Splunk App for Lookup File Editing 3 Splunk MCP Server 3 Universal Forwarder 3 Splunk Enterprise Security (ES) 2 Cisco Talos Intelligence for Enterprise Security Cloud 2 Splunk Enterprise Security 2 Zoom app for Splunk SOAR 1 Splunk App for SOAR 1 Splunk/UniversalForwarder for Windows 1 Splunk Add-on for Palo Alto Networks 1 Splunk Supporting Add-on for Active Directory 1 Splunk CloudConnect SDK 1 Splunk App for Stream 1 AWS IAM app for Splunk SOAR 1 Universal Forwarders 1 Splunk On-Call (VictorOps) 1 Cisco Webex app for Splunk SOAR 1 MS Graph for Active Directory app for Splunk SOAR 1 RSA SecurID Authentication Manager app for Splunk SOAR 1 Splunk MCP Server app 1 Nmap Scanner 1 Splunk Attack Analyzer Connector for Splunk SOAR 1 Splunk SOAR (On-premises) 1 Venafi app for Splunk SOAR 1 Splunk SOAR (Cloud) 1 Cisco Secure Malware Analytics app for Splunk SOAR 1 CrowdStrike OAuth API app for Splunk SOAR 1 Splunk ITSI 1 FireAMP 1
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Low 2.7
    CVE-2026-76371

    Incorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAR

    In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to …

    Splunk FireAMP
  • Low 2.7
    CVE-2026-76369

    Path Traversal through Automation Broker in Splunk SOAR

    In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writi…

    Splunk Splunk SOAR
  • Low 2.7
    CVE-2026-76368

    Missing Authorization through Playbooks in Splunk SOAR

    In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not chec…

    Splunk Splunk SOAR
  • Low 2.7
    CVE-2026-76361

    Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR

    In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether intern…

    Splunk Splunk SOAR
  • Low 3.8
    CVE-2026-76348

    Missing Authorization in Search Head Cluster Member Controls in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control endpoints and change…

    Splunk Splunk Enterprise
  • Low 3.5
    CVE-2026-20137

    Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122, a low-privileged user who does not hold the "admin" or "power" Splunk roles could b…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 2.7
    CVE-2025-20388

    Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumer…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 2.4
    CVE-2025-20385

    Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a user who holds a role with a high privilege capability `admin_all_objects` could craft a malicious pay…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 3.5
    CVE-2025-20382

    URL validation bypass through Views Dashboard in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.10, 10.0.2503.8, and 9.3.2411.120, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a views dashb…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 2.7
    CVE-2025-20373

    Sensitive Information Disclosure in “_internal“ index through Splunk Add-On for Palo Alto Networks

    In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the _internal index during the addition of new “Data Security Accounts“. The vulnerability would require either local access to the log files or a…

    Splunk Splunk Add-on for Palo Alto Networks
  • Low 3.5
    CVE-2025-20379

    Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a save…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 3.1
    CVE-2025-20378

    Open Redirect on Web Login endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the `return_to` parameter of the Splunk Web lo…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 3.1
    CVE-2025-20325

    Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster [splunk.secret](https://help.splunk.com/en/spl…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 2.5
    CVE-2025-20233

    Incorrect permissions set by the “chmod“ and “makedirs“ Python functions in Splunk App for Lookup File Editing

    In the Splunk App for Lookup File Editing versions below 4.0.5, a script in the app used the `chmod` and `makedirs` Python functions in a way that resulted in overly broad read and execute permissions. This could lead to improper access control for a low-priv…

    Splunk Splunk App for Lookup File Editing
  • Low 3.1
    CVE-2024-53245

    Information Disclosure due to Username Collision with a Role that has the same Name as the User

    In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 3.0
    CVE-2022-43562

    Host Header Injection in Splunk Enterprise

    In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and c…

    Splunk Splunk Enterprise
  • Low 2.6
    CVE-2022-37438

    Information disclosure via the dashboard drilldown in Splunk Enterprise

    In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown comp…

    Splunk Splunk Enterprise Splunk Cloud Platform