CVE-2026-20239

Published May 20, 2026

Last updated 2 months ago

CVSS high 7.5

Splunk

Splunk Enterprise

Splunk Cloud Platform

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-20239 is an information disclosure vulnerability affecting specific versions of Splunk Enterprise and Splunk Cloud Platform. The flaw allows a user with access to the `_internal` index to view sensitive data, including session cookies and response bodies. This vulnerability stems from a lack of output buffer sanitization within the `TcpChannel` component. When socket errors occur, this component logs the full contents of I/O buffers at a WARN level, inadvertently exposing sensitive information. Affected Splunk Enterprise versions are those below 10.2.2 and 10.0.5, while Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13 are also impacted.

Description: In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the `_internal` index could view session cookies and response bodies that contain sensitive data.
Source: psirt@cisco.com
NVD status: Analyzed
Products: splunk, splunk_cloud_platform

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

psirt@cisco.com: CWE-532

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "D5A01879-50A5-4266-A08C-F55584F442ED",
            "versionEndExcluding": "10.0.5",
            "versionStartIncluding": "10.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "9F3A147D-2A67-469A-A223-248DEFB413E0",
            "versionEndExcluding": "10.2.2",
            "versionStartIncluding": "10.2.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D5C098C2-9ED5-41B4-BE57-984B71027144",
            "versionEndExcluding": "10.0.2503.13",
            "versionStartIncluding": "10.0.2503",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2C302734-E81B-49DE-B3D6-ACD20DD3A57A",
            "versionEndExcluding": "10.1.2507.21",
            "versionStartIncluding": "10.1.2507",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5F7423BE-EADA-4D07-A021-D0F9EBBF966F",
            "versionEndExcluding": "10.2.2510.11",
            "versionStartIncluding": "10.2.2510",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8E24DFCE-B632-49F0-9198-A21636FC3D59",
            "versionEndExcluding": "10.3.2512.8",
            "versionStartIncluding": "10.3.2512",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.