Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120, a user with access to the Splunk _internal index could view SAML configurations for Attribute query requests or Authentication extensions in plain text within the conf.log file. This vulnerability poses a risk to the confidentiality and integrity of sensitive information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2026-20144 |
Exploitation
To exploit this vulnerability, an attacker with a role that has access to the Splunk _internal index can access the conf.log file. By doing so, they can view sensitive SAML configurations in plain text, which could lead to unauthorized access or manipulation of authentication processes.
Affected Products
- Splunk Enterprise versions below 10.2.0
- Splunk Enterprise versions below 10.0.2
- Splunk Enterprise versions below 9.4.7
- Splunk Enterprise versions below 9.3.8
- Splunk Enterprise versions below 9.2.11
- Splunk Cloud Platform versions below 10.2.2510.0
- Splunk Cloud Platform versions below 10.1.2507.11
- Splunk Cloud Platform versions below 10.0.2503.9
- Splunk Cloud Platform versions below 9.3.2411.120
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform. Additionally, restricting access to the Splunk _internal index can help prevent unauthorized users from viewing sensitive configurations.