CVE-2025-20231: Insertion of Sensitive Information into Log File

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search using the permissions of a...

CVE-2025-20228: Cross-Site Request Forgery (CSRF)

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store KVStore through a...

CVE-2025-20230: Improper Access Control

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and delete other user data in App Key Value...

CVE-2025-20229: Improper Access Control

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution RCE through a file...

CVE-2025-20226: Exposure of Sensitive Information to an Unauthorized Actor

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search with a risky command using the permission...

PT-2025-13016 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.3.3 Splunk Enterprise versions prior to 9.2.5 Splunk Enterprise versions prior to 9.1.8 Splunk Cloud Platform versions prior to 9.3.2408.103 Splunk Cloud Platform versions prior to 9.2.2406.108 Splunk Clo...

PT-2025-13017

Name of the Vulnerable Software and Affected Versions Splunk App for Lookup File Editing versions prior to 4.0.5 Description The issue is related to improper access control due to overly broad read and execute permissions. A script in the app used the chmod and makedirs Python functions in a way...

PT-2025-13019

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.4.1 Splunk Enterprise versions prior to 9.3.3 Splunk Enterprise versions prior to 9.2.5 Splunk Enterprise versions prior to 9.1.8 Splunk Secure Gateway app on Splunk Cloud Platform versions prior to 3.8.38...

Splunk Enterprise 9.1.0 < 9.1.8, 9.2.0 < 9.2.5, 9.3.0 < 9.3.3, 9.4.0 < 9.4.1 (SVD-2025-0307)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0307 advisory. - In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure...

Splunk Enterprise 9.1.0 < 9.1.8, 9.2.0 < 9.2.5, 9.3.0 < 9.3.3 (SVD-2025-0303)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0303 advisory. - In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and...

Splunk Enterprise 9.1.0 < 9.1.8, 9.2.0 < 9.2.5, 9.3.0 < 9.3.3, 9.4.0 < 9.4.1 (SVD-2025-0306)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0306 advisory. - In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107,...

Splunk Enterprise 9.1.0 < 9.1.8, 9.2.0 < 9.2.5, 9.3.0 < 9.3.3, 9.4.0 < 9.4.1 (SVD-2025-0305)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0305 advisory. - In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107,...

Splunk Enterprise 9.1.0 < 9.1.8, 9.2.0 < 9.2.5, 9.3.0 < 9.3.3, 9.4.0 < 9.4.1 (SVD-2025-0302)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0302 advisory. - In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure...

CVE-2025-29923 vulnerabilities

Vulnerabilities for packages: fluent-bit-plugin-loki, atlantis, kots, gitea, falcosidekick, oauth2-proxy, splunk-otel-collector, authservice...

GHSA-92CP-5422-2MW7 vulnerabilities

Vulnerabilities for packages: fluent-bit-plugin-loki, atlantis, kots, gitea, falcosidekick, oauth2-proxy, splunk-otel-collector, authservice...

CVE-2025-29923 vulnerabilities

Vulnerabilities for packages: gitea, fluent-bit-plugin-loki, authservice, splunk-otel-collector, falcosidekick-fips, falcosidekick, atlantis, kots, loki-fips, gitea-fips, dapr, dapr-fips, keda, argo-cd-fips, oauth2-proxy, splunk-otel-collector-fips, traefik-fips, rekor-fips, loki, juicefs,...

GHSA-92CP-5422-2MW7 vulnerabilities

Vulnerabilities for packages: gitea, fluent-bit-plugin-loki, authservice, splunk-otel-collector, falcosidekick-fips, falcosidekick, atlantis, kots, loki-fips, gitea-fips, dapr, dapr-fips, keda, argo-cd-fips, oauth2-proxy, splunk-otel-collector-fips, traefik-fips, rekor-fips, loki, juicefs,...

GHSA-93MQ-9FFX-83M2 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, argo-workflows-fips, amazon-cloudwatch-agent-fips, splunk-otel-collector, eks-distro, nats, kubeflow-pipelines, argo-rollouts-fips, amazon-cloudwatch-agent, argo-rollouts, kargo, keda, argo-cd-fips, eks-distro-fips, argo-workflows,...

Splunk Active Directory Add-on Regular Expression DoS

The vulnerability of the Active Directory data extraction application “Splunk Supporting Add-on for Active Directory” is related to the use of a regular expression with high computational complexity. Exploiting this vulnerability could allow an attacker to cause a service failure...

Splunk App for SOAR Privilege Escalation

The vulnerability of the Splunk App for SOAR software relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...