CVE-2026-20166: Exposure of Sensitive Information to an Unauthorized Actor

In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve the Observability Cloud API access token through the Discover...

Splunk Cloud Platform and Splunk Enterprise have command injection vulnerabilities

Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. Vulnerabilities exist in versions of...

Splunk Enterprise Cross-Site Script Vulnerability

Splunk Enterprise is a data collection and analysis software developed by the American company Splunk. Versions of Splunk Enterprise prior to 10.2.0, 10.0.3 prior to version 10.0.3, 9.4.9 prior to version 9.3.9, as well as versions of Splunk Cloud Platform prior to 10.2.2510.4, 10.1.2507.15 prior...

Splunk Cloud Platform and Splunk Enterprise have vulnerabilities related to information leakage

Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. Vulnerabilities exist in versions of...

Splunk Enterprise information leakage vulnerability

Splunk Enterprise is a data collection and analysis software developed by the American company Splunk. Versions of Splunk Enterprise prior to 10.2.0, 10.0.3 prior to version 10.0.3, 9.4.9 prior to version 9.3.10, as well as versions of Splunk Cloud Platform prior to 10.2.2510.5, 10.1.2507.16 prio...

CVE-2026-20164: Exposure of Sensitive Information to an Unauthorized Actor

In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, and 9.3.2411.123, a low-privileged user that does not hold the "admin" or "power" Splunk roles could access the...

Splunk Cloud Platform and Splunk Enterprise log information leakage vulnerabilities

Splunk Cloud Platform and Splunk Enterprise are both products of the American company Splunk. Splunk Cloud Platform is a powerful service for data collection, processing, and analysis. Splunk Enterprise is a suite of software for data collection and analysis. Vulnerabilities regarding log...

📄 Splunk Enterprise 9.1.5 / 9.2.2 Remote Code Execution

This PHP script is a proof of concept exploit for CVE-2024-36985, an authenticated Remote Code Execution vulnerability affecting Splunk instances where the splunkarchiver app is installed and enabled. It is a conversion of a Metasploit module into PHP...

📄 Splunk Enterprise 9.1.5 / 9.2.2 Remote Code Execution

Proof of concept exploit for a critical authenticated remote code execution vulnerability that affects multiple versions of Splunk Enterprise when the splunkarchiver application is enabled...

📄 Splunk Enterprise 9.1.5 / 9.2.2 Vulnerability Scanner

This PHP script is a defensive vulnerability checker for CVE-2024-36985 affecting Splunk Enterprise. It authenticates to a Splunk instance using provided credentials, retrieves the installed Splunk version, and determines whether it falls within the vulnerable ranges. The script then enumerates...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: trivy-operator, crossplane-provider-aws-kinesis, pulumi, kube-rbac-proxy, sops, kyverno-policy-reporter, cilium-cli, flux-kustomize-controller, ollama, linkerd2, zarf, vertical-pod-autoscaler, azure-service-operator, src, mattermost, opa, traefik, tekton-pipelines,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: trivy-operator, crossplane-provider-aws-kinesis, pulumi, kube-rbac-proxy, sops, kyverno-policy-reporter, cilium-cli, flux-kustomize-controller, ollama, linkerd2, zarf, vertical-pod-autoscaler, azure-service-operator, src, mattermost, opa, traefik, tekton-pipelines,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-backup, apm-server-fips, tigera-operator, crossplane-provider-aws-wafv2-fips, crossplane-provider-aws-wafv2, kube-logging-operator, crossplane-provider-aws-sqs-fips, linkerd2, crossplane-provider-aws-ssm-fips, nova-fips,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-backup, apm-server-fips, tigera-operator, crossplane-provider-aws-wafv2-fips, crossplane-provider-aws-wafv2, kube-logging-operator, crossplane-provider-aws-sqs-fips, linkerd2, crossplane-provider-aws-ssm-fips, nova-fips,...

Splunk Enterprise 8.2.9 / 9.0.2 Vulnerability Scanner

This is a scanner that checks if a Splunk Enterprise system is susceptible to CVE‑2022‑43571, an authenticated remote code execution vulnerability. The vulnerability exists due to insufficient input sanitization in SimpleXML dashboard style parameters such as lineColor or fillColor. When a...

Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

Splunk has fixed vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. The vulnerabilities are in several versions of Splunk Enterprise and Splunk Cloud Platform. They allow low-privileged users to bypass protections, view sensitive information, and abuse the REST API for user...

📄 Splunk Enterprise 8.2.9 / 9.0.2 Authenticated Remote Code Execution

Proof of concept exploit for CVE-2022-43571, a critical authenticated remote code execution vulnerability affecting Splunk Enterprise versions 8.2.9 and 9.0.2. The flaw resides in the SimpleXML dashboard PDF generation process, where insufficient input sanitization allows a privileged authenticat...

CVE-2026-20144

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120, a user of a Splunk Search Head Cluster SHC deployment who holds a role with access to the the Splunk internal index coul...

CVE-2026-20139

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload into the...

CVE-2026-20141

In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin" Splunk role could access the Splunk Monitoring Console App endpoints due to an improper access control. This could lead to a sensitive information disclosure. The Monitoring...