What’s Vulnerable › Vulnerabilities
CVE-2026-20164: Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-11 · updated 2026-06-17
- Weakness: CWE-200
Description
In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, and 9.3.2411.123, a low-privileged user that does not hold the "admin" or "power" Splunk roles could access the `/splunkd/__raw/servicesNS/-/-/configs/conf-passwords` REST API endpoint, which exposes the hashed or plaintext password values that are stored in the passwords.conf configuration file due to improper access control. This vulnerability could allow for the unauthorized disclosure of sensitive credentials.
Affected products
- Splunk Enterprise: from 9.3.0 before 9.3.10; from 9.4.0 before 9.4.9; from 10.0.0 before 10.0.3 — fixed in 10.0.3, 9.3.10, 9.4.9
- Splunk Cloud Platform: from 9.3.2411 before 9.3.2411.123; from 10.0.2503 before 10.0.2503.11; from 10.1.2507 before 10.1.2507.16; from 10.2.2510 before 10.2.2510.5 — fixed in 10.0.2503.11, 10.1.2507.16, 10.2.2510.5, 9.3.2411.123
How to fix
Upgrade to a fixed version: Splunk Enterprise 10.0.3, 9.3.10, 9.4.9; Splunk Cloud Platform 10.0.2503.11, 10.1.2507.16, 10.2.2510.5, 9.3.2411.123. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-20164 or the next vulnerability affects your stack