# Multiple Splunk Enterprise Vulnerabilities Enable Path Traversal and Information Disclosure (CVE-2026-20296, CVE-2026-20297, CVE-2026-20298)

> Splunk PSIRT disclosed three vulnerabilities affecting Splunk Enterprise and Splunk Cloud Platform: a CSRF flaw in the Deployment Server component enabling arbitrary SPL search execution as splunk-system-user (CVE-2026-20296, CVSS 8.3), a path traversal in the App Install REST endpoint allowing writes outside the intended app directory into $SPLUNK_HOME/etc/ (CVE-2026-20297, CVSS 7.2), and an information disclosure flaw exposing encrypted password hashes via the storage/passwords REST endpoint to low-privileged users (CVE-2026-20298, CVSS 5.3).

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1409
- **ID:** TL-2026-1409
- **Severity:** HIGH (CVSS 8.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20296, CVE-2026-20297, CVE-2026-20298

## Description

On 2026-07-15, Splunk published three coordinated Vulnerability Disclosure advisories (SVD-2026-0702, SVD-2026-0703, SVD-2026-0704) covering distinct but related weaknesses in Splunk Enterprise and Splunk Cloud Platform.

CVE-2026-20296 (CVSS 3.1: 8.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L, CWE-352) is a Cross-Site Request Forgery vulnerability in the Deployment Server functionality of Splunk Web. Deployment Server endpoints fail to validate CSRF tokens on GET requests, and caller-supplied input is not correctly neutralized before being placed into an SPL search string. An attacker can craft a malicious link that, when clicked by a victim holding the `list_deployment_server` capability, causes the victim's browser to issue a forged GET request that triggers an arbitrary SPL search executed with the privileges of the `splunk-system-user` account. Because the system account has broad read access across indexed data and Splunk's internal configuration store, a successful attack can expose indexed log data and stored credentials without the attacker ever directly authenticating.

CVE-2026-20297 (CVSS 3.1: 7.2, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-22) is a path traversal vulnerability in the App Install REST endpoint, specifically in handling of the `explicit_appname` parameter during app installation. A user holding both the `edit_local_apps` and `install_apps` capabilities can supply a crafted app name/path that escapes the intended per-app install directory and writes arbitrary files into `$SPLUNK_HOME/etc/` or its subdirectories. Because that directory tree holds Splunk's own configuration files (server.conf, authentication.conf, app manifests, etc.), an attacker who already has app-install rights can use the traversal to overwrite trusted configuration or drop files that Splunk will later load or execute, providing a path to further privilege escalation or persistence beyond what the app-install capability alone would allow.

CVE-2026-20298 (CVSS 3.1: 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-200) is an information disclosure vulnerability in the `/servicesNS/-/-/storage/passwords` REST endpoint. The endpoint returns the `encr_password` field in results even to callers who lack the `admin` or `power` roles, when queried indirectly through the SPL `|rest` command. A low-privileged, authenticated user can therefore retrieve other users' and app-integration's encrypted (Splunk-obfuscated) credential material, which can subsequently be decrypted offline if the attacker also obtains the instance's shared secret (splunk.secret), or used to identify credential reuse and pivot targets.

All three issues affect the same Splunk Enterprise release lineage: versions before 10.4.1, 10.2.5, 10.0.8, and 9.4.13 are vulnerable to all three CVEs; the 9.3.x branch (fixed in 9.3.14) is vulnerable only to CVE-2026-20297. Splunk Cloud Platform instances are affected below vendor-managed version thresholds and were patched automatically by Splunk; self-managed Splunk Enterprise customers must apply the fixed releases themselves. Splunk's advisories note no publicly available workaround for CVE-2026-20297 (upgrade required) and a configuration-based mitigation for CVE-2026-20298 (`mask_encr_password = true` under `[storage_passwords_masking]` in limits.conf, plus a restart). No in-the-wild exploitation or public proof-of-concept code had been reported as of the 2026-07-16 disclosure reporting; this is a vendor-disclosed, patch-available advisory rather than an actively exploited campaign.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1566.002 Spearphishing Link
- T1190 Exploit Public-Facing Application
- T1204.001 Malicious Link
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1574 Hijack Execution Flow
- T1211 Exploitation for Stealth
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1069 Permission Groups Discovery
- T1518 Software Discovery
- T1078 Valid Accounts
- T1119 Automated Collection
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1565.001 Stored Data Manipulation

## Sources

- [Splunk Advisory SVD-2026-0702 (CVE-2026-20296)](https://advisory.splunk.com/advisories/SVD-2026-0702)
- [Splunk Advisory SVD-2026-0703 (CVE-2026-20297)](https://advisory.splunk.com/advisories/SVD-2026-0703)
- [Splunk Advisory SVD-2026-0704 (CVE-2026-20298)](https://advisory.splunk.com/advisories/SVD-2026-0704)
- [Multiple Splunk Enterprise Vulnerabilities Patched](https://cybersecuritynews.com/multiple-splunk-enterprise-vulnerabilities-patched/)
- [NVD - CVE-2026-20296](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-20296)
- [Splunk Security Advisories Archive](https://advisory.splunk.com/advisories)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1409