CVE-2026-20251: Splunk Secure Gateway jsonpickle Deserialization RCE with Public PoC

CVE-2026-20251 (TL-2026-1203), also tracked as 2026FO-SPLUNK-20251, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-07-11. It has no confirmed attribution, affects Splunk Splunk Secure Gateway, references 1 CVE (CVE-2026-20251), maps to 18 MITRE ATT&CK techniques (T1005, T1059, T1059.004), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-1203

Threat ID
TL-2026-1203
Also known as
2026FO-SPLUNK-20251
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-11
Last reviewed
2026-07-11
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, government administration, finance, health, critical-infrastructure, managed-security-service-providers
Target regions
Global
Detection rules
9
Indicators of compromise
17

Malware and tooling in CVE-2026-20251

Malware and tooling: jsonpickle

A validator short-circuit flaw in Splunk Secure Gateway's alert processing pipeline lets a low-privileged authenticated user smuggle a jsonpickle py/reduce gadget into the mobile_alerts KV Store collection, achieving remote code execution as the Splunk service account. A working public PoC (poc_cve_2026_20251.py) was released 2026-06-26 by Fady Oueslati of ReactiveZero Security Research.

How CVE-2026-20251 works

CVE-2026-20251 (CWE-502, CVSS 3.1 8.8 HIGH, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) resides in Splunk Secure Gateway (SSG), the app that backs Splunk Mobile, Spacebridge, and Mission Control. SSG's alert processing pipeline reads attacker-controlled documents from the Splunk App Key Value Store (KV Store), specifically the mobile_alerts collection, and passes them directly to jsonpickle.decode() inside bin/spacebridgeapp/request/alerts_request_processor.py. Although the call sets safe=True, that flag only blocks the legacy py/repr evaluation path; critical gadget tags including py/reduce, py/object, py/type, py/function, and py/module remain fully exploitable under this configuration.

A secondary validator, check_alert_data_valid_json() in bin/spacebridgeapp/rest/devices/alert_helper.py, is supposed to gate untrusted documents before they reach the deserializer, but it short-circuits on the first recognized key: if the top-level key contains a permitted py/object value beginning with 'spacebridgeapp' (e.g. spacebridgeapp.data.alert_data.Alert), the function immediately returns True and never inspects sibling keys. An attacker exploits this by placing the trusted py/object marker first and hiding a py/reduce gadget chain in a sibling 'notification' key. The publicly released PoC demonstrates the gadget invoking subprocess.check_output(['uname', '-a']) to prove command execution, but the same primitive generalizes to arbitrary OS command execution.

Exploitation requires only a valid low-privileged Splunk account (no admin or power role) with write access to the mobile_alerts KV Store collection via the Splunk REST API, and the ability to trigger an alert-fetch request so SSG processes the planted document. No user interaction beyond attacker-controlled API calls is required, and the vulnerability is remotely reachable over the network (AV:N). Because SSG runs with the privileges of the underlying Splunk service account, successful exploitation yields full compromise of confidentiality, integrity, and availability on the Splunk host.

Vendor advisory SVD-2026-0601 was published 2026-06-10 crediting researcher M Mahdan Argya Syarif (0xbeludan) for the original responsible disclosure; the independent public PoC by Fady Oueslati / ReactiveZero Security Research followed on 2026-06-26, after fixed versions were already available, giving defenders a patch window but also handing attackers a working exploit. As of this writing the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so exploitation in the wild is not yet confirmed; exploitability is assessed as POC_PUBLIC rather than ACTIVE.

MITRE ATT&CK techniques used in TL-2026-1203

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1203 Exploitation for Client Execution; T1610 Deploy Container

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Defense Evasion

T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Impact

T1489 Service Stop

Persistence

T1505 Server Software Component

Credential Access

T1552 Unsecured Credentials

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CVE-2026-20251

  • Splunk — Splunk Secure Gateway
    Vulnerable versions: < 3.8.67; < 3.9.20; < 3.10.6
    Fixed in: 3.8.67; 3.9.20; 3.10.6
  • Splunk — Splunk Enterprise
    Vulnerable versions: 9.3.0-9.3.12; 9.4.0-9.4.11; 10.0.0-10.0.6; 10.2.0-10.2.3; < 10.4.0
    Fixed in: 9.3.13; 9.4.12; 10.0.7; 10.2.4; 10.4.0
  • Splunk — Splunk Cloud Platform
    Vulnerable versions: < 9.3.2411.132; < 10.1.2507.22; < 10.2.2510.14; < 10.3.2512.12
    Fixed in: 9.3.2411.132; 10.1.2507.22; 10.2.2510.14; 10.3.2512.12

Remediation for CVE-2026-20251

Patches

  • Splunk Secure Gateway 3.9.20 / 3.10.6 / 3.8.67
  • Splunk Enterprise 10.0.7 / 10.2.4 / 10.4.0 / 9.4.12 / 9.3.13
  • Splunk Cloud Platform 10.3.2512.12 / 10.2.2510.14 / 10.1.2507.22 / 9.3.2411.132

Immediate actions

  • Disable or remove the Splunk Secure Gateway app if Splunk Mobile, Spacebridge, or Mission Control functionality is not required
  • Restrict write access to the mobile_alerts KV Store collection to trusted, least-privilege service accounts only
  • Audit existing mobile_alerts KV Store documents for anomalous py/object or py/reduce keys
  • Enforce least-privilege Splunk roles and remove unnecessary low-privileged accounts that could stage the exploit

Workarounds

  • Disable the Splunk Secure Gateway app entirely as a short-term mitigation (breaks Splunk Mobile/Spacebridge/Mission Control)
  • Restrict REST API write access to the mobile_alerts KV Store collection at the role/capability level

Longer-term hardening

  • Upgrade Splunk Secure Gateway to 3.9.20, 3.10.6, or 3.8.67 or later
  • Upgrade Splunk Enterprise to 10.0.7, 10.2.4, 10.4.0, 9.4.12, or 9.3.13 or later depending on branch
  • Upgrade Splunk Cloud Platform instances to 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, or 9.3.2411.132 or later
  • Replace jsonpickle.decode() on attacker-reachable code paths with strict schema-validated parsers or an explicit class allowlist
  • Rework alert_helper.py validation logic to fully traverse nested structures instead of short-circuiting on the first recognized key
  • Monitor Splunk internal logs for unexpected subprocess execution originating from spacebridgeapp components

CVEs associated with CVE-2026-20251

CVE-2026-20251

Weaknesses (CWE) in CVE-2026-20251

CWE-502

Timeline of CVE-2026-20251

  • CVE-2026-20251 is published in the NVD with CVSS 3.1 base score 8.8 and CWE-502 classification.
  • Splunk publishes vendor advisory SVD-2026-0601 for CVE-2026-20251, crediting researcher M Mahdan Argya Syarif (0xbeludan) for responsible disclosure, and ships patched versions of Splunk Secure Gateway, Splunk Enterprise, and Splunk Cloud Platform.
  • NVD entry for CVE-2026-20251 last modified.
  • ReactiveZero Security Research's GitHub write-up documents the full three-step exploit chain — (1) attacker writes a crafted document to the mobile_alerts KV Store collection via the Splunk REST API, (2) check_alert_data_valid_json() short-circuits on the trusted leading py/object key, (3) jsonpickle.decode(safe=True) still executes the sibling py/reduce gadget — and publishes the exact malicious JSON payload structure using py/object, notification, py/reduce, py/function, and py/tuple tags.
  • ReactiveZero Security Research publicly releases poc_cve_2026_20251.py on GitHub under reference 2026FO-SPLUNK-20251, demonstrating the validator short-circuit bypass and jsonpickle deserialization RCE.
  • Fady Oueslati of ReactiveZero Security Research tests the exploit against SSG 3.9.19 with Splunk Enterprise 10.0.6 on macOS x86_64, confirming remote code execution via the py/reduce gadget.
  • Cyber Security News, Cyberpress, Cryptika, and TeamWin publish independent technical writeups covering the public PoC and remediation guidance.
  • CVE-2026-20251 confirmed not present in the CISA Known Exploited Vulnerabilities catalog as of this analysis; no confirmed in-the-wild exploitation to date.

Sources cited for CVE-2026-20251

Threats related to CVE-2026-20251

Detection coverage for TL-2026-1203

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1203 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats