Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121, a low-privileged user could craft a malicious payload into specific parameters of the REST API endpoint when changing a password. This could lead to a client-side denial-of-service (DoS), significantly slowing page load times or rendering Splunk Web temporarily unresponsive.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-20139 |
Exploitation
To exploit this vulnerability, a low-privileged user must send a crafted request to the REST API endpoint while changing their password. By manipulating the `realname`, `tz`, or `email` parameters, the user can inject a malicious payload that may cause performance issues, leading to a denial-of-service condition on the client side.
Affected Products
- Splunk Enterprise versions below 10.2.0
- Splunk Enterprise versions below 10.0.2
- Splunk Enterprise versions below 9.4.8
- Splunk Enterprise versions below 9.3.9
- Splunk Enterprise versions below 9.2.12
- Splunk Cloud Platform versions below 10.2.2510.3
- Splunk Cloud Platform versions below 10.1.2507.8
- Splunk Cloud Platform versions below 10.0.2503.9
- Splunk Cloud Platform versions below 9.3.2411.121
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform that are not affected by this issue. Additionally, restricting access to the REST API endpoint for low-privileged users can help prevent exploitation.