What’s Vulnerable › Vulnerabilities
CVE-2026-20137: Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise
- Severity: medium (CVSS 5.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-18 · updated 2026-06-17
- Weakness: CWE-200
Description
In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122, a low-privileged user who does not hold the "admin" or "power" Splunk roles could bypass the SPL safeguards for risky commands when they create a Data Model that contains an injected SPL query within an object. They can bypass the safeguards by exploiting a path traversal vulnerability.
Affected products
- Splunk Enterprise: from 9.2.0 before 9.2.9; from 9.3.0 before 9.3.7; from 9.4.0 before 9.4.5; from 10.0.0 before 10.0.3 — fixed in 10.0.3, 9.2.9, 9.3.7, 9.4.5
- Splunk Cloud Platform: from 9.3.2408 before 9.3.2408.122; from 9.3.2411 before 9.3.2411.112; from 10.0.2503 before 10.0.2503.9; 10.1.2507 — fixed in 10.0.2503.9, 9.3.2408.122, 9.3.2411.112
How to fix
Upgrade to a fixed version: Splunk Enterprise 10.0.3, 9.2.9, 9.3.7, 9.4.5; Splunk Cloud Platform 10.0.2503.9, 9.3.2408.122, 9.3.2411.112. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-20137 or the next vulnerability affects your stack