# CVE-2026-20251: Splunk Secure Gateway jsonpickle Deserialization RCE with Public PoC

> A validator short-circuit flaw in Splunk Secure Gateway's alert processing pipeline lets a low-privileged authenticated user smuggle a jsonpickle py/reduce gadget into the mobile_alerts KV Store collection, achieving remote code execution as the Splunk service account. A working public PoC (poc_cve_2026_20251.py) was released 2026-06-26 by Fady Oueslati of ReactiveZero Security Research.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1203
- **ID:** TL-2026-1203
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20251

## Description

CVE-2026-20251 (CWE-502, CVSS 3.1 8.8 HIGH, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) resides in Splunk Secure Gateway (SSG), the app that backs Splunk Mobile, Spacebridge, and Mission Control. SSG's alert processing pipeline reads attacker-controlled documents from the Splunk App Key Value Store (KV Store), specifically the mobile_alerts collection, and passes them directly to jsonpickle.decode() inside bin/spacebridgeapp/request/alerts_request_processor.py. Although the call sets safe=True, that flag only blocks the legacy py/repr evaluation path; critical gadget tags including py/reduce, py/object, py/type, py/function, and py/module remain fully exploitable under this configuration.

A secondary validator, check_alert_data_valid_json() in bin/spacebridgeapp/rest/devices/alert_helper.py, is supposed to gate untrusted documents before they reach the deserializer, but it short-circuits on the first recognized key: if the top-level key contains a permitted py/object value beginning with 'spacebridgeapp' (e.g. spacebridgeapp.data.alert_data.Alert), the function immediately returns True and never inspects sibling keys. An attacker exploits this by placing the trusted py/object marker first and hiding a py/reduce gadget chain in a sibling 'notification' key. The publicly released PoC demonstrates the gadget invoking subprocess.check_output(['uname', '-a']) to prove command execution, but the same primitive generalizes to arbitrary OS command execution.

Exploitation requires only a valid low-privileged Splunk account (no admin or power role) with write access to the mobile_alerts KV Store collection via the Splunk REST API, and the ability to trigger an alert-fetch request so SSG processes the planted document. No user interaction beyond attacker-controlled API calls is required, and the vulnerability is remotely reachable over the network (AV:N). Because SSG runs with the privileges of the underlying Splunk service account, successful exploitation yields full compromise of confidentiality, integrity, and availability on the Splunk host.

Vendor advisory SVD-2026-0601 was published 2026-06-10 crediting researcher M Mahdan Argya Syarif (0xbeludan) for the original responsible disclosure; the independent public PoC by Fady Oueslati / ReactiveZero Security Research followed on 2026-06-26, after fixed versions were already available, giving defenders a patch window but also handing attackers a working exploit. As of this writing the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so exploitation in the wild is not yet confirmed; exploitability is assessed as POC_PUBLIC rather than ACTIVE.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1610 Deploy Container
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1489 Service Stop

## Sources

- [Public PoC Released for Deserialization RCE Vulnerability in Splunk Secure Gateway](https://cybersecuritynews.com/splunk-secure-gateway-deserialization-rce-vulnerability/)
- [SVD-2026-0601: Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway](https://advisory.splunk.com/advisories/SVD-2026-0601)
- [CVE-2026-20251 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-20251)
- [CVE-2026-20251 — Splunk Secure Gateway jsonpickle deserialization RCE (CVSS 8.8) | ReactiveZero Security Research](https://github.com/reactivezero/CVE-2026-20251)
- [Splunk Secure Gateway RCE Flaw Lets Low-Privileged Users Execute OS Commands](https://cyberpress.org/splunk-secure-gateway-rce-flaw/)
- [Public PoC Released for Deserialization RCE Vulnerability in Splunk Secure Gateway](https://teamwin.in/public-poc-released-for-deserialization-rce-vulnerability-in-splunk-secure-gateway/)
- [Public PoC Released for Deserialization RCE Vulnerability in Splunk Secure Gateway](https://www.cryptika.com/public-poc-released-for-deserialization-rce-vulnerability-in-splunk-secure-gateway/)
- [CVE-2026-20251 - Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway](https://cvefeed.io/vuln/detail/CVE-2026-20251)
- [CVE-2026-20251: application deserializes untrusted data without sufficiently verifying resulting data - Threat Radar](https://radar.offseq.com/threat/cve-2026-20251-the-application-deserializes-untrus-e1432431)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1203