What’s Vulnerable › Vulnerabilities

CVE-2023-32713: Local Privilege Escalation via the ‘streamfwd’ program in Splunk App for Stream

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-01 · updated 2026-06-17
• Weakness: CWE-269

Description

In Splunk App for Stream versions below 8.1.1, a low-privileged user could use a vulnerability in the streamfwd process within the Splunk App for Stream to escalate their privileges on the machine that runs the Splunk Enterprise instance, up to and including the root user.

Affected products

• Splunk App for Stream: before 8.1.1 — fixed in 8.1.1

How to fix

Upgrade to a fixed version: Splunk App for Stream 8.1.1. Check the vendor advisory for mitigations.

References

• https://advisory.splunk.com/advisories/SVD-2023-0607
• https://advisory.splunk.com/advisories/SVD-2023-0607

Get alerted when CVE-2023-32713 or the next vulnerability affects your stack