Multiple Splunk Enterprise Vulnerabilities Enable Path Traversal and Information Disclosure (CVE-2026-20296, CVE-2026-20297, CVE-2026-20298)

Multiple Splunk Enterprise Vulnerabilities Enable Path (TL-2026-1409) is a high-severity software vulnerability scored CVSS 8.3, first published 2026-07-16. It has no confirmed attribution, affects Splunk Splunk Enterprise, references 3 CVEs (CVE-2026-20296, CVE-2026-20297, CVE-2026-20298), maps to 19 MITRE ATT&CK techniques (T1005, T1059, T1068), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1409

Threat ID
TL-2026-1409
Severity
HIGH
CVSS
8.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-16
Last reviewed
2026-07-16
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
all sectors using splunk enterprise, government administration, finance, health, technology, managed security service providers
Target regions
Global
Detection rules
9
Indicators of compromise
16

Splunk PSIRT disclosed three vulnerabilities affecting Splunk Enterprise and Splunk Cloud Platform: a CSRF flaw in the Deployment Server component enabling arbitrary SPL search execution as splunk-system-user (CVE-2026-20296, CVSS 8.3), a path traversal in the App Install REST endpoint allowing writes outside the intended app directory into $SPLUNK_HOME/etc/ (CVE-2026-20297, CVSS 7.2), and an information disclosure flaw exposing encrypted password hashes via the storage/passwords REST endpoint to low-privileged users (CVE-2026-20298, CVSS 5.3).

How Multiple Splunk Enterprise Vulnerabilities Enable Path works

On 2026-07-15, Splunk published three coordinated Vulnerability Disclosure advisories (SVD-2026-0702, SVD-2026-0703, SVD-2026-0704) covering distinct but related weaknesses in Splunk Enterprise and Splunk Cloud Platform.

CVE-2026-20296 (CVSS 3.1: 8.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L, CWE-352) is a Cross-Site Request Forgery vulnerability in the Deployment Server functionality of Splunk Web. Deployment Server endpoints fail to validate CSRF tokens on GET requests, and caller-supplied input is not correctly neutralized before being placed into an SPL search string. An attacker can craft a malicious link that, when clicked by a victim holding the `list_deployment_server` capability, causes the victim's browser to issue a forged GET request that triggers an arbitrary SPL search executed with the privileges of the `splunk-system-user` account. Because the system account has broad read access across indexed data and Splunk's internal configuration store, a successful attack can expose indexed log data and stored credentials without the attacker ever directly authenticating.

CVE-2026-20297 (CVSS 3.1: 7.2, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-22) is a path traversal vulnerability in the App Install REST endpoint, specifically in handling of the `explicit_appname` parameter during app installation. A user holding both the `edit_local_apps` and `install_apps` capabilities can supply a crafted app name/path that escapes the intended per-app install directory and writes arbitrary files into `$SPLUNK_HOME/etc/` or its subdirectories. Because that directory tree holds Splunk's own configuration files (server.conf, authentication.conf, app manifests, etc.), an attacker who already has app-install rights can use the traversal to overwrite trusted configuration or drop files that Splunk will later load or execute, providing a path to further privilege escalation or persistence beyond what the app-install capability alone would allow.

CVE-2026-20298 (CVSS 3.1: 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-200) is an information disclosure vulnerability in the `/servicesNS/-/-/storage/passwords` REST endpoint. The endpoint returns the `encr_password` field in results even to callers who lack the `admin` or `power` roles, when queried indirectly through the SPL `|rest` command. A low-privileged, authenticated user can therefore retrieve other users' and app-integration's encrypted (Splunk-obfuscated) credential material, which can subsequently be decrypted offline if the attacker also obtains the instance's shared secret (splunk.secret), or used to identify credential reuse and pivot targets.

All three issues affect the same Splunk Enterprise release lineage: versions before 10.4.1, 10.2.5, 10.0.8, and 9.4.13 are vulnerable to all three CVEs; the 9.3.x branch (fixed in 9.3.14) is vulnerable only to CVE-2026-20297. Splunk Cloud Platform instances are affected below vendor-managed version thresholds and were patched automatically by Splunk; self-managed Splunk Enterprise customers must apply the fixed releases themselves. Splunk's advisories note no publicly available workaround for CVE-2026-20297 (upgrade required) and a configuration-based mitigation for CVE-2026-20298 (`mask_encr_password = true` under `[storage_passwords_masking]` in limits.conf, plus a restart). No in-the-wild exploitation or public proof-of-concept code had been reported as of the 2026-07-16 disclosure reporting; this is a vendor-disclosed, patch-available advisory rather than an actively exploited campaign.

MITRE ATT&CK techniques used in TL-2026-1409

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories

Execution

T1059 Command and Scripting Interpreter; T1204.001 Malicious Link

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Discovery

T1069 Permission Groups Discovery; T1518 Software Discovery

stealth

T1078 Valid Accounts

Initial Access

T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

Defense Evasion

T1211 Exploitation for Stealth; T1574 Hijack Execution Flow

Persistence

T1505 Server Software Component

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files

Impact

T1565.001 Stored Data Manipulation

Resource Development

T1587.004 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in Multiple Splunk Enterprise Vulnerabilities Enable Path

  • Splunk — Splunk Enterprise
    Vulnerable versions: 10.4.0; 10.2.0-10.2.4; 10.0.0-10.0.7; 9.4.0-9.4.12; 9.3.0-9.3.13
    Fixed in: 10.4.1; 10.2.5; 10.0.8; 9.4.13; 9.3.14 (CVE-2026-20297 only)
  • Splunk — Splunk Cloud Platform
    Vulnerable versions: below 10.5.2605.0; below 10.4.2604.7; below 10.3.2512.16; below 10.2.2510.18; below 10.1.2507.24
    Fixed in: 10.5.2605.0; 10.4.2604.7; 10.3.2512.16; 10.2.2510.18; 10.1.2507.24

Remediation for Multiple Splunk Enterprise Vulnerabilities Enable Path

Patches

  • Splunk Enterprise 10.4.1
  • Splunk Enterprise 10.2.5
  • Splunk Enterprise 10.0.8
  • Splunk Enterprise 9.4.13
  • Splunk Enterprise 9.3.14 (CVE-2026-20297 only)

Immediate actions

  • Upgrade Splunk Enterprise to 10.4.1, 10.2.5, 10.0.8, 9.4.13, or later (9.3.14 for CVE-2026-20297 on the 9.3 branch)
  • Confirm Splunk Cloud Platform instances have received the vendor-managed patch (versions at or above 10.5.2605.0 / 10.4.2604.7 / 10.3.2512.16 / 10.2.2510.18 / 10.1.2507.24 depending on release train)
  • Add `mask_encr_password = true` under the `[storage_passwords_masking]` stanza in limits.conf and restart Splunk Enterprise as an interim mitigation for CVE-2026-20298 where immediate upgrade is not possible
  • Audit role assignments for the `list_deployment_server`, `edit_local_apps`, and `install_apps` capabilities and restrict to the minimum necessary set of administrators

Workarounds

  • No workaround available for CVE-2026-20297 (path traversal) — upgrade required
  • limits.conf mask_encr_password=true mitigates CVE-2026-20298 credential exposure pending upgrade
  • Restricting/auditing list_deployment_server capability reduces CVE-2026-20296 CSRF exposure pending upgrade

Longer-term hardening

  • Enforce CSRF-safe browsing hygiene for Splunk Web administrators (no clicking untrusted links while authenticated to Splunk Web sessions)
  • Deploy network-level access restrictions to Splunk Web / management ports so they are not reachable from general user network segments
  • Rotate stored credentials in Splunk (storage/passwords entries) that may have been exposed to low-privileged accounts prior to patching
  • Monitor Splunk internal logs (_internal, audit index) for anomalous `| rest` queries against storage/passwords and unexpected app-install activity outside change windows

CVEs associated with Multiple Splunk Enterprise Vulnerabilities Enable Path

CVE-2026-20296, CVE-2026-20297, CVE-2026-20298

Weaknesses (CWE) in Multiple Splunk Enterprise Vulnerabilities Enable Path

CWE-352, CWE-22, CWE-200

Timeline of Multiple Splunk Enterprise Vulnerabilities Enable Path

  • Splunk Cloud Platform instances automatically patched to vendor-managed versions (10.5.2605.0, 10.4.2604.6/7, 10.3.2512.15/16, 10.2.2510.18, 10.1.2507.24) across affected release trains.
  • Splunk Enterprise 9.3.14 released, fixing CVE-2026-20297 only on the 9.3.x branch.
  • Splunk Enterprise 10.4.1, 10.2.5, 10.0.8, and 9.4.13 released, fixing all three CVEs (2026-20296, 2026-20297, 2026-20298).
  • Splunk publishes advisory SVD-2026-0704 disclosing CVE-2026-20298 (information disclosure of encrypted password hashes via storage/passwords endpoint, CVSS 5.3).
  • Splunk publishes advisory SVD-2026-0703 disclosing CVE-2026-20297 (path traversal in App Install REST endpoint, CVSS 7.2).
  • Splunk publishes advisory SVD-2026-0702 disclosing CVE-2026-20296 (CSRF in Deployment Server enabling arbitrary SPL execution, CVSS 8.3).
  • No in-the-wild exploitation or public proof-of-concept code identified as of hunt/research time; treated as vendor-disclosed, patch-available advisory.
  • cybersecuritynews.com reports on the three disclosed Splunk Enterprise vulnerabilities, summarizing CVSS scores and fixed versions.

Sources cited for Multiple Splunk Enterprise Vulnerabilities Enable Path

Threats related to Multiple Splunk Enterprise Vulnerabilities Enable Path

Detection coverage for TL-2026-1409

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1409 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats