Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster deployment who holds a role with access to the Splunk _internal index could view the integrationKey, secretKey, and appSecretKey secrets in plain text. This vulnerability poses a significant risk to the confidentiality and integrity of sensitive information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2026-20138 |
Exploitation
To exploit this vulnerability, an attacker with a role that has access to the Splunk _internal index can execute queries to retrieve sensitive keys stored in plain text. This requires the attacker to have high privileges within the Splunk environment, making it essential for organizations to restrict access to the _internal index.
Affected Products
- Splunk Enterprise versions below 10.2.0
- Splunk Enterprise version 10.0.2
- Splunk Enterprise version 9.4.7
- Splunk Enterprise version 9.3.9
- Splunk Enterprise version 9.2.11
Mitigation
To mitigate this vulnerability, organizations should upgrade to the latest version of Splunk Enterprise that addresses this issue. Additionally, it is crucial to review and restrict user roles and permissions to limit access to the Splunk _internal index, thereby reducing the risk of unauthorized access to sensitive information.