- Description
- In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could view stored credential hashes when they access the `/servicesNS/-/-/storage/passwords` REST endpoint through the `|rest` Search Processing Language (SPL) command.<br><br>The exposure happens because the `|rest` SPL command returns the `encr_password` field in the results of the `/servicesNS/-/-/storage/passwords` REST endpoint.
- Source
- psirt@cisco.com
- NVD status
- Analyzed
- Products
- splunk, splunk_cloud_platform
CVSS 3.1
- Type
- Primary
- Base score
- 6.5
- Impact score
- 3.6
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity
- MEDIUM
- psirt@cisco.com
- CWE-200
- Hype score
- Not currently trending
Splunk has patched critical vulnerabilities in its Enterprise and Cloud Platform, including CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298. Users should update to versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, or later to mitigate these security risks. #Splunk #CyberSecurity https
@dailytechonx
16 Jul 2026
48 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Splunk patched three Splunk Enterprise vulnerabilities: CVE-2026-20296 CSRF, CVE-2026-20297 path traversal, and CVE-2026-20298 credential exposure. #Splunk #CVE202620296 #CSRF #Vulnerability #InfoSec https://t.co/7CTU3nXz5t
@Daily_CyberSec
16 Jul 2026
362 Impressions
2 Retweets
2 Likes
1 Bookmark
0 Replies
0 Quotes
🚨*CVE* CVE-2026-20298 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18,… https://t.co/oMn2pRAYJT ----- Traducción: CVE-2026-20298 En … https://t.co/utmtNg
@infoflowcloud
15 Jul 2026
28 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "8BEBD0A0-2CFD-4DDE-BF01-E64A9D7FD14C",
"versionEndExcluding": "9.4.13",
"versionStartIncluding": "9.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "BAF52B7B-401D-405E-B6A1-CA8C9AB33F85",
"versionEndExcluding": "10.0.8",
"versionStartIncluding": "10.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "58788CC8-B767-4050-A31A-47AC5DDF1EA3",
"versionEndExcluding": "10.2.5",
"versionStartIncluding": "10.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:splunk:splunk:10.4.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "C3506A1D-BEF7-4FAF-8B98-4977A35EEA59",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FC8B8DC4-E9D1-4EF1-893F-62223F3FBB2C",
"versionEndExcluding": "10.1.2507.24",
"versionStartIncluding": "10.1.2507",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"matchCriteriaId": "24742A7B-F291-4FBD-91C1-45D7892507C5",
"versionEndExcluding": "10.2.2510.18",
"versionStartIncluding": "10.2.2510",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1D9A962E-D1A3-4F88-9286-359E029A28E7",
"versionEndExcluding": "10.3.2512.15",
"versionStartIncluding": "10.3.2512",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0CCEB685-9F6C-482E-BB8A-6FD2E1A7E246",
"versionEndExcluding": "10.4.2604.6",
"versionStartIncluding": "10.4.2604",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]