Skip to content
OpenAdvisories

Vendor

Splunk

347 known vulnerabilities.

Products

Splunk Enterprise 259 Splunk Cloud Platform 89 Splunk SOAR 31 Splunk Secure Gateway 20 Splunk AI Toolkit 12 Splunk Cloud 11 Splunk Enterprise Cloud 5 Splunk Connect for Kafka 4 Splunk Light 4 Splunk Add-on Builder 3 AD LDAP app for Splunk SOAR 3 Splunk App for Lookup File Editing 3 Splunk MCP Server 3 Universal Forwarder 3 Splunk Enterprise Security (ES) 2 Cisco Talos Intelligence for Enterprise Security Cloud 2 Splunk Enterprise Security 2 Zoom app for Splunk SOAR 1 Splunk App for SOAR 1 Splunk/UniversalForwarder for Windows 1 Splunk Add-on for Palo Alto Networks 1 Splunk Supporting Add-on for Active Directory 1 Splunk CloudConnect SDK 1 Splunk App for Stream 1 AWS IAM app for Splunk SOAR 1 Universal Forwarders 1 Splunk On-Call (VictorOps) 1 Cisco Webex app for Splunk SOAR 1 MS Graph for Active Directory app for Splunk SOAR 1 RSA SecurID Authentication Manager app for Splunk SOAR 1 Splunk MCP Server app 1 Nmap Scanner 1 Splunk Attack Analyzer Connector for Splunk SOAR 1 Splunk SOAR (On-premises) 1 Venafi app for Splunk SOAR 1 Splunk SOAR (Cloud) 1 Cisco Secure Malware Analytics app for Splunk SOAR 1 CrowdStrike OAuth API app for Splunk SOAR 1 Splunk ITSI 1 FireAMP 1
All Critical High Medium Low Exploited only Public exploit

183 results · Clear filters · Feed

  • Medium 5.7
    CVE-2026-76318

    Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs …

    Splunk Splunk Enterprise
  • Medium 4.3
    CVE-2026-76309

    Structured Query Language (SQL) Injection through the REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inject Structured Query Language (SQL) through the Representational State Transfer (REST) API, causing S…

    Splunk Splunk Enterprise
  • Medium 5.4
    CVE-2026-76263

    Improper Access Control through the REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 (SPL2) modules belonging to other users through the data management orchestrator interface. T…

    Splunk Splunk Enterprise
  • Medium 5.3
    CVE-2026-76261

    Insecure Default Access Control List through the REST API in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read Spacebridge asymmetric private keys, which are…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 6.5
    CVE-2026-76260

    Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the rest_properties_get capability could read encrypted stored credentials through the Representational State Transfer (REST) API. Successful exploitation ca…

    Splunk Splunk Enterprise
  • Medium 6.5
    CVE-2026-76258

    Use of Hard-coded Cryptographic Key through Companion App Registration in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who does not hold the "admin" or "power" Splunk roles could register an arbitrary companion app and cause Splu…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 4.3
    CVE-2026-76256

    Information Exposure through REST API Endpoints in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language s…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 6.5
    CVE-2026-76257

    Missing Authorization through REST API Endpoints in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway adm…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 6.4
    CVE-2026-76255

    Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language (SPL) commands through the Data Model Editor using …

    Splunk Splunk Enterprise
  • Medium 6.8
    CVE-2026-76252

    Cross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to al…

    Splunk Splunk Enterprise
  • Medium 5.3
    CVE-2026-20298

    Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk rol…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2026-20265

    Insecure Default Domain Allowlist in Splunk AI Toolkit

    In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exf…

    Splunk Splunk AI Toolkit
  • Medium 4.3
    CVE-2026-20260

    Log Injection through HTTP Request Paths in Splunk SOAR

    In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request p…

    Splunk Splunk SOAR
  • Medium 5.7
    CVE-2026-20257

    Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cra…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.5
    CVE-2026-20259

    Improper Access Control in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds a Splunk role that contains the high-privilege capability `…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2026-20255

    Improper Input Validation through Classic Dashboards in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cra…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2026-20254

    Information Disclosure through External Content Restriction Bypass in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could cra…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2026-20256

    Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could cau…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2026-20238

    Improper Access Control through Role Inheritance in Splunk AI Toolkit app

    In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data that was restricted through `srchFilter` configurations on custom roles.<br><br>The app contains an `authorize.conf…

    Splunk Splunk AI Toolkit
  • Medium 4.3
    CVE-2026-20203

    Improper Access Control in Data Model Acceleration in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `pow…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.6
    CVE-2026-20202

    Improper Input Validation during User Account Creation in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.20, 10.0.2503.13, and 9.3.2411.127, a user who holds a role that contains the high-privilege cap…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.3
    CVE-2026-20162

    Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.9, and Splunk Cloud Platform versions below 10.2.2510.4, 10.1.2507.15, 10.0.2503.11, and 9.3.2411.123, a low-privileged user who does not hold the "admin" or "power" Splunk roles could craft a…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2026-20166

    Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise

    In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve the Observability Cloud AP…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2026-20164

    Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, and 9.3.2411.123, a low-privileged user that does not hold the "admin" or "power" Splunk roles could acces…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.3
    CVE-2026-20165

    Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9.3.2411.124, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retri…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.8
    CVE-2026-20142

    Sensitive Information Disclosure in "_internal" index in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the RSA `accessKey` value from the [<u>Authentication…

    Splunk Splunk Enterprise
  • Medium 6.8
    CVE-2026-20138

    Sensitive Information Disclosure in "_internal" index in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the `integrationKey`, `secretKey`, and `appSecretKey`…

    Splunk Splunk Enterprise
  • Medium 4.3
    CVE-2026-20139

    Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.8
    CVE-2026-20144

    Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with acce…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2026-20141

    Improper Access Control in Splunk Monitoring Console App

    In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin" Splunk role could access the Splunk Monitoring Console App endpoints due to an improper access control. This could lead to a sensitive in…

    Splunk Splunk Enterprise
  • Medium 4.3
    CVE-2025-20389

    Improper Input Validation in "label" column field in Splunk Secure Gateway App

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cr…

    Splunk Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway
  • Medium 4.3
    CVE-2025-20383

    Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mo…

    Splunk Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway
  • Medium 5.3
    CVE-2025-20384 Public exploit

    Unauthenticated Log Injection in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes int…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2025-20381

    SPL commands allowlist controls bypass in Splunk MCP Server app through "run_splunk_query" MCP tool

    In Splunk MCP Server app versions below 0.2.4, a user with access to the "run_splunk_query" Model Context Protocol (MCP) tool could bypass the SPL command allowlist controls in MCP by embedding SPL commands as sub-searches, leading to unauthorized actions bey…

    Splunk Splunk MCP Server
  • Medium 5.7
    CVE-2025-20368

    Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk Enterprise

    In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2025-20367

    Reflected Cross-site Scripting (XSS) in '/app/search/table' endpoint through the 'dataset.command' parameter on Splunk Enterprise

    In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious payload thro…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.9
    CVE-2025-20370

    Denial of Service (DoS) through Multiple LDAP Bind Requests in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a user who holds a role that contains the high-privilege capability `change_authentication`, could send …

    Splunk Splunk Enterprise Splunk Enterprise Cloud
  • Medium 6.5
    CVE-2025-20366

    Improper Access Control in Background Job Submission in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privileged user that does not hold the admin or power Splunk roles could access sensitive search results …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.6
    CVE-2025-20369

    Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise

    In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup l…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2025-20322

    Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated attacker could send a specially-crafted SPL search command that could trigger a roll…

    Splunk Splunk Enterprise Splunk Enterprise Cloud