Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster deployment who holds a role with access to the Splunk _internal index could view the RSA accessKey value from the Authentication.conf file in plain text. This vulnerability poses a risk to the confidentiality and integrity of sensitive information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2026-20142 |
Exploitation
To exploit this vulnerability, an attacker with a role that has access to the Splunk _internal index can execute a search query to retrieve the RSA accessKey value from the Authentication.conf file. This requires the attacker to have high privileges within the Splunk environment, making it essential for organizations to restrict access to sensitive roles.
Affected Products
- Splunk Enterprise versions below 10.2.0
- Splunk Enterprise version 10.0.2
- Splunk Enterprise version 9.4.7
- Splunk Enterprise version 9.3.9
- Splunk Enterprise version 9.2.11
Mitigation
To mitigate this vulnerability, organizations should upgrade to the latest version of Splunk Enterprise that addresses this issue. Additionally, it is crucial to review and restrict access permissions for roles that can access the Splunk _internal index to minimize the risk of unauthorized access to sensitive information.