CVE-2026-20298

🗓️ 15 Jul 2026 17:18:32Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 17 Views🌐 WEB

CVE-2026-20298: Low-privilege users can view credential hashes via the storage passwords REST endpoint in Splunk Enterprise.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-20298	15 Jul 202617:18	–	attackerkb
Circl	CVE-2026-20298	16 Jul 202602:11	–	circl
Cvelist	CVE-2026-20298 Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise	15 Jul 202617:18	–	cvelist
EUVD	EUVD-2026-44738	15 Jul 202617:18	–	euvd
NCSC	Vulnerabilities in Splunk Enterprise and Splunk Cloud Platform	17 Jul 202614:27	–	ncsc
NVD	CVE-2026-20298	15 Jul 202618:16	–	nvd
Positive Technologies	PT-2026-60235	15 Jul 202600:00	–	ptsecurity
Tenable Nessus	Splunk Enterprise 9.4.0 < 9.4.13, 10.0.0 < 10.0.8, 10.2.0 < 10.2.5, 10.4.0 < 10.4.1 (SVD-2026-0704)	15 Jul 202600:00	–	nessus
Vulnrichment	CVE-2026-20298 Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise	15 Jul 202617:18	–	vulnrichment

NVD

Node

splunk splunkRange9.4.0–9.4.13enterprise

splunk splunkRange10.0.0–10.0.8enterprise

splunk splunkRange10.2.0–10.2.5enterprise

splunk splunkMatch10.4.0enterprise

Node

splunk splunk_cloud_platformRange10.1.2507–10.1.2507.24

splunk splunk_cloud_platformRange10.2.2510–10.2.2510.18

splunk splunk_cloud_platformRange10.3.2512–10.3.2512.15

splunk splunk_cloud_platformRange10.4.2604–10.4.2604.6

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "10.4",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.4.1"
      },
      {
        "version": "10.2",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.2.5"
      },
      {
        "version": "10.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.0.8"
      },
      {
        "version": "9.4",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.4.13"
      }
    ]
  },
  {
    "product": "Splunk Cloud Platform",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "10.5.2605",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.5.2605.0"
      },
      {
        "version": "10.4.2604",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.4.2604.6"
      },
      {
        "version": "10.3.2512",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.3.2512.15"
      },
      {
        "version": "10.2.2510",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.2.2510.18"
      },
      {
        "version": "10.1.2507",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.1.2507.24"
      }
    ]
  }
]

Source	Link
advisory	www.advisory.splunk.com/advisories/SVD-2026-0704

Parameter	Position	Path	Description	CWE
encr_password	path	servicesNS/-/-/storage/passwords	Low-privilege user can view stored credential hashes via the /servicesNS/-/-/storage/passwords REST endpoint when using \|rest SPL; exposure occurs because the encr_password field is returned in the results.	CWE-200

24 Jul 2026 18:11Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.15.3 - 6.5

EPSS0.00231

SSVC

CWE-200