What’s Vulnerable › Vulnerabilities

CVE-2024-29945: Splunk Authentication Token Exposure in Debug Log in Splunk Enterprise

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-27 · updated 2026-06-17
• Weakness: CWE-532

Description

In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure happens when either Splunk Enterprise runs in debug mode or the JsonWebToken component has been configured to log its activity at the DEBUG logging level.

Affected products

• Splunk Enterprise: from 9.0.0 before 9.0.9; from 9.1.0 before 9.1.4; from 9.2.0 before 9.2.1 — fixed in 9.0.9, 9.1.4, 9.2.1

How to fix

Upgrade to a fixed version: Splunk Enterprise 9.0.9, 9.1.4, 9.2.1. Check the vendor advisory for mitigations.

References

• https://advisory.splunk.com/advisories/SVD-2024-0301
• https://research.splunk.com/application/9a67e749-d291-40dd-8376-d422e7ecf8b5
• https://advisory.splunk.com/advisories/SVD-2024-0301
• https://research.splunk.com/application/9a67e749-d291-40dd-8376-d422e7ecf8b5

Get alerted when CVE-2024-29945 or the next vulnerability affects your stack