Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user without the admin Splunk role could access the Splunk Monitoring Console App endpoints due to improper access control. This could lead to sensitive information disclosure. The Monitoring Console app is bundled with Splunk Enterprise and is not available for download on SplunkBase.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-20141 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can access the Splunk Monitoring Console App endpoints. By doing so, they may gain access to sensitive information that should be restricted to users with higher privileges. This can be achieved without any user interaction, making it easier for attackers to exploit the flaw.
Affected Products
- Splunk Enterprise versions below 10.0.2
- Splunk Enterprise versions below 10.0.3
- Splunk Enterprise versions below 9.4.8
- Splunk Enterprise versions below 9.3.9
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise that are not affected by this issue. Additionally, ensure that proper access controls are in place to restrict access to sensitive applications and endpoints.