Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122, a low-privileged user can bypass SPL safeguards for risky commands. This occurs when they create a Data Model containing an injected SPL query within an object, exploiting a path traversal vulnerability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 3.5 | CVE-2026-20137 |
Exploitation
To exploit this vulnerability, a low-privileged user must create a Data Model that includes an injected SPL query. By doing so, they can bypass the safeguards that are meant to protect against risky commands, allowing them to execute unauthorized actions within the Splunk environment.
Affected Products
- Splunk Enterprise versions below 10.2.0
- Splunk Enterprise versions below 10.0.3
- Splunk Enterprise versions below 9.4.5
- Splunk Enterprise versions below 9.3.7
- Splunk Enterprise versions below 9.2.9
- Splunk Cloud Platform versions below 10.1.2507.0
- Splunk Cloud Platform versions below 10.0.2503.9
- Splunk Cloud Platform versions below 9.3.2411.112
- Splunk Cloud Platform versions below 9.3.2408.122
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform. Additionally, restricting access to low-privileged users and monitoring for unusual activity can help prevent exploitation.