CVE-2026-20164

Received Received - Intake

Unauthorized Access to Passwords via Splunk REST API Endpoint

Publication date: 2026-03-11

Last updated on: 2026-03-24

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, and 9.3.2411.123, a low-privileged user that does not hold the "admin" or "power" Splunk roles could access the `/splunkd/__raw/servicesNS/-/-/configs/conf-passwords` REST API endpoint, which exposes the hashed or plaintext password values that are stored in the passwords.conf configuration file due to improper access control. This vulnerability could allow for the unauthorized disclosure of sensitive credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-11

Last Modified

2026-03-24

Generated

2026-07-06

AI Q&A

2026-03-11

EPSS Evaluated

2026-07-05

NVD

CVE-2026-20164

EUVD

EUVD-2026-11230

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk	From 10.0.0 (inc) to 10.0.3 (exc)
splunk	splunk	From 9.4.0 (inc) to 9.4.9 (exc)
splunk	splunk	From 9.3.0 (inc) to 9.3.10 (exc)
splunk	splunk_cloud_platform	From 9.3.2411 (inc) to 9.3.2411.123 (exc)
splunk	splunk_cloud_platform	From 10.0.2503 (inc) to 10.0.2503.11 (exc)
splunk	splunk_cloud_platform	From 10.1.2507 (inc) to 10.1.2507.16 (exc)
splunk	splunk_cloud_platform	From 10.2.2510 (inc) to 10.2.2510.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-20164 is a medium-severity vulnerability affecting certain versions of Splunk Enterprise and Splunk Cloud Platform. It occurs because of improper access control in a REST API endpoint (/splunkd/__raw/servicesNS/-/-/configs/conf-passwords). This flaw allows low-privileged users who do not have the "admin" or "power" roles to access hashed or plaintext password values stored in the passwords.conf configuration file.'}, {'type': 'paragraph', 'content': 'This unauthorized access leads to the disclosure of sensitive credentials, which is classified as an information exposure vulnerability (CWE-200).'}] [1]

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive credentials stored in the Splunk system. If a low-privileged user exploits this flaw, they could obtain hashed or plaintext passwords, potentially allowing them to escalate privileges or access other parts of the system.

Such exposure increases the risk of further attacks, unauthorized access, and compromise of the affected environment.

Compliance Impact

I don't know

Detection Guidance

This vulnerability involves unauthorized access to the /splunkd/__raw/servicesNS/-/-/configs/conf-passwords REST API endpoint by low-privileged users. Detection would involve monitoring access attempts to this specific REST API endpoint.

However, no specific detection commands or tools are provided in the available resources.

Mitigation Strategies

The only mitigation available is to upgrade affected Splunk Enterprise and Splunk Cloud Platform versions to fixed releases.

Upgrade Splunk Enterprise to version 10.2.0, 10.0.3, 9.4.9, 9.3.10 or higher.
Upgrade Splunk Cloud Platform to versions 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, 9.3.2411.123 or higher.

No other mitigations or workarounds are available according to the advisory.

Hi! I’m here to help you understand CVE-2026-20164. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70