Splunk has released patches for three vulnerabilities affecting Splunk Enterprise and Splunk Cloud Platform, including a high-severity CSRF flaw in Deployment Server and a path traversal bug in the app installation workflow.
The most severe issue, tracked as CVE-2026-20296, carries a CVSSv3.1 score of 8.3 and stems from the absence of CSRF token validation on GET requests to Deployment Server endpoints in Splunk Web.
The flaw (Advisory SVD-2026-0702, CWE-352) allows an attacker to phish a victim who holds a role with the list_deployment_server capability into unknowingly triggering arbitrary Search Processing Language (SPL) searches.
Multiple Splunk Enterprise Flaws Patched
Because these searches execute as splunk-system-user, a successful attack could expose stored credentials and indexed data.
The vulnerability requires user interaction, meaning the attacker cannot exploit it at will and must first lure the victim into initiating a malicious request through their browser.
The bug affects Splunk Enterprise versions before 10.4.1, 10.2.5, 10.0.8, and 9.4.13, as well as several Splunk Cloud Platform builds.
Splunk credits its own researcher for identifying the issue and recommends upgrading to the patched versions. As a workaround, organizations that don’t require Splunk Web can disable it entirely to eliminate the attack surface.
The second high-severity issue, CVE-2026-20297 (SVD-2026-0703, CWSS 7.2, CWE-22), involves a path traversal vulnerability through the explicit_appname parameter in the App Install REST endpoint.
A user holding a role with both edit_local_apps and install_apps capabilities could manipulate the installation path to write files outside the intended app directory, landing them instead in $SPLUNK_HOME/etc/ and its subdirectories.
This escalation path is notable because it requires high privileges (PR:H), but no user interaction, and the impact spans confidentiality, integrity, and availability, suggesting an attacker could plant malicious files in sensitive system locations.
Splunk found no viable mitigations or workarounds for this issue, making the version upgrade the only remediation path. Affected versions mirror those in the CSRF advisory, with fixes available in 10.4.1, 10.2.5, 10.0.8, 9.4.13, 9.3.14, and corresponding Cloud Platform builds.
Rounding out the disclosures is CVE-2026-20298 (SVD-2026-0704, CVSSv3.1 5.3, CWE-200), a medium-severity information disclosure bug affecting the /servicesNS/-/-/storage/passwords REST endpoint.
Low-privileged users lacking admin or power roles could use the |rest SPL command to view stored credential encr_password hashes, since the endpoint fails to filter that field from search results.
Unlike the other two advisories, this one requires a two-step remediation: upgrading to the patched Splunk Enterprise version, then manually editing limits.conf to set mask_encr_password = true under the [storage_passwords_masking] stanza, followed by a restart.
Mitigation
Security teams running self-managed Splunk Enterprise should prioritize patching, particularly for the CSRF and path traversal issues given their high severity and potential for privilege escalation or data exposure. Key steps include:
- Upgrade to Splunk Enterprise 10.4.1, 10.2.5, 10.0.8, 9.4.13, or 9.3.14 depending on your current branch.
- Apply the
limits.confconfiguration change for CVE-2026-20298 after upgrading. - Consider disabling Splunk Web where feasible as an interim CSRF mitigation.
- Review role-based capability assignments, especially
install_apps,edit_local_apps, andlist_deployment_server, to limit exposure.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
