CVE-2026-20164
Received Received - Intake
Unauthorized Access to Passwords via Splunk REST API Endpoint

Publication date: 2026-03-11

Last updated on: 2026-03-24

Assigner: Cisco Systems, Inc.

Description
In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, and 9.3.2411.123, a low-privileged user that does not hold the "admin" or "power" Splunk roles could access the `/splunkd/__raw/servicesNS/-/-/configs/conf-passwords` REST API endpoint, which exposes the hashed or plaintext password values that are stored in the passwords.conf configuration file due to improper access control. This vulnerability could allow for the unauthorized disclosure of sensitive credentials.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-11
Last Modified
2026-03-24
Generated
2026-06-16
AI Q&A
2026-03-11
EPSS Evaluated
2026-06-14
NVD
CVE-2026-20164
EUVD
EUVD-2026-11230
Affected Vendors & Products
Showing 7 associated CPEs
Vendor Product Version / Range
splunk splunk From 10.0.0 (inc) to 10.0.3 (exc)
splunk splunk From 9.4.0 (inc) to 9.4.9 (exc)
splunk splunk From 9.3.0 (inc) to 9.3.10 (exc)
splunk splunk_cloud_platform From 9.3.2411 (inc) to 9.3.2411.123 (exc)
splunk splunk_cloud_platform From 10.0.2503 (inc) to 10.0.2503.11 (exc)
splunk splunk_cloud_platform From 10.1.2507 (inc) to 10.1.2507.16 (exc)
splunk splunk_cloud_platform From 10.2.2510 (inc) to 10.2.2510.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-20164 is a medium-severity vulnerability affecting certain versions of Splunk Enterprise and Splunk Cloud Platform. It occurs because of improper access control in a REST API endpoint (/splunkd/__raw/servicesNS/-/-/configs/conf-passwords). This flaw allows low-privileged users who do not have the "admin" or "power" roles to access hashed or plaintext password values stored in the passwords.conf configuration file.'}, {'type': 'paragraph', 'content': 'This unauthorized access leads to the disclosure of sensitive credentials, which is classified as an information exposure vulnerability (CWE-200).'}] [1]

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive credentials stored in the Splunk system. If a low-privileged user exploits this flaw, they could obtain hashed or plaintext passwords, potentially allowing them to escalate privileges or access other parts of the system.

Such exposure increases the risk of further attacks, unauthorized access, and compromise of the affected environment.

Compliance Impact

I don't know

Detection Guidance

This vulnerability involves unauthorized access to the /splunkd/__raw/servicesNS/-/-/configs/conf-passwords REST API endpoint by low-privileged users. Detection would involve monitoring access attempts to this specific REST API endpoint.

However, no specific detection commands or tools are provided in the available resources.

Mitigation Strategies

The only mitigation available is to upgrade affected Splunk Enterprise and Splunk Cloud Platform versions to fixed releases.

  • Upgrade Splunk Enterprise to version 10.2.0, 10.0.3, 9.4.9, 9.3.10 or higher.
  • Upgrade Splunk Cloud Platform to versions 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, 9.3.2411.123 or higher.

No other mitigations or workarounds are available according to the advisory.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart