A critical remote code execution vulnerability has been disclosed in Splunk Secure Gateway, tracked as CVE-2026-20251 with a CVSS score of 8.8 (High).
The flaw enables a low-privileged authenticated user to execute arbitrary operating system commands on the underlying Splunk host without any administrative access.
The vulnerability was discovered by security researcher Fady Oueslati of ReactiveZero Security Research. The vulnerability stems from how Splunk Secure Gateway processes alert documents retrieved from its internal KV Store.
Splunk Secure Gateway RCE Flaw
The alerts_request_processor.py component reads documents from the mobile_alerts collection and passes them directly to jsonpickle.decode() a Python deserialization function capable of reconstructing arbitrary Python objects.
Although the call uses the safe=True flag, this setting only restricts the legacy py/repr evaluation path. Dangerous tags such as py/reduce, py/function, py/object, py/type, and py/module remain fully exploitable and are completely unaffected by this flag.
A secondary control, check_alert_data_valid_json(), was designed to block malicious serialization tags before deserialization occurs. However, the validator contains a critical logic flaw; it short-circuits on the very first recognized key.
If the document’s first top-level key is a permitted py/object value beginning with spacebridgeapp, the function immediately returns True without ever inspecting sibling keys.
An attacker exploits this by placing a trusted key first while embedding a malicious py/reduce gadget deeper in the document structure, effectively bypassing the only defense standing between the payload and the deserializer.
Exploitation requires only a valid low-privilege Splunk account. The attacker writes a specially crafted bypass document to the mobile_alerts KV Store collection via Splunk’s REST API; no admin or power role is required.
When Splunk Secure Gateway later processes an alert fetch request, the flawed validator approves the document after inspecting only the first key.
The approved document is then passed to jsonpickle.decode(), which fires the embedded py/reduce gadget and executes arbitrary code as the Splunk service account, granting full OS-level command execution on the host.
Affected Versions and Fixes
| Branch | Fixed Version |
|---|---|
| Splunk Secure Gateway 3.8.x | 3.8.67 |
| Splunk Secure Gateway 3.9.x | 3.9.20 |
| Splunk Secure Gateway 3.10.x | 3.10.6 |
| Splunk Enterprise | 10.0.7 / 10.2.4 / 10.4.0+ |
Organizations should immediately upgrade Splunk Secure Gateway and Splunk Enterprise to the patched releases.
Where patching is not immediately possible, administrators should disable the Splunk Secure Gateway app if it is not actively in use and restrict KV Store write access by enforcing least-privilege roles and auditing ACLs on the mobile_alerts collection.
From a defensive engineering standpoint, jsonpickle.decode() should never be used on externally influenced data. Replacing it with a strict, schema-validated parser or supplying an explicit classes= allow-list significantly reduces deserialization risk.
Input validators must also fully traverse nested document structures rather than short-circuiting on the first matched key, the precise design flaw that made this vulnerability exploitable. A proof-of-concept has been published to GitHub demonstrating both the validator bypass and unsafe code execution.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 vulnerability has been disclosed in Splunk Secure Gateway (SSG), tracked as CVE-2026-20251, allowing a low-privileged authenticated user to execute arbitrary OS commands on the underlying Splunk host.){kind=link}