CVE-2026-20164
Unauthorized Access to Passwords via Splunk REST API Endpoint
Publication date: 2026-03-11
Last updated on: 2026-03-24
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| splunk | splunk | From 10.0.0 (inc) to 10.0.3 (exc) |
| splunk | splunk | From 9.4.0 (inc) to 9.4.9 (exc) |
| splunk | splunk | From 9.3.0 (inc) to 9.3.10 (exc) |
| splunk | splunk_cloud_platform | From 9.3.2411 (inc) to 9.3.2411.123 (exc) |
| splunk | splunk_cloud_platform | From 10.0.2503 (inc) to 10.0.2503.11 (exc) |
| splunk | splunk_cloud_platform | From 10.1.2507 (inc) to 10.1.2507.16 (exc) |
| splunk | splunk_cloud_platform | From 10.2.2510 (inc) to 10.2.2510.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-20164 is a medium-severity vulnerability affecting certain versions of Splunk Enterprise and Splunk Cloud Platform. It occurs because of improper access control in a REST API endpoint (/splunkd/__raw/servicesNS/-/-/configs/conf-passwords). This flaw allows low-privileged users who do not have the "admin" or "power" roles to access hashed or plaintext password values stored in the passwords.conf configuration file.'}, {'type': 'paragraph', 'content': 'This unauthorized access leads to the disclosure of sensitive credentials, which is classified as an information exposure vulnerability (CWE-200).'}] [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive credentials stored in the Splunk system. If a low-privileged user exploits this flaw, they could obtain hashed or plaintext passwords, potentially allowing them to escalate privileges or access other parts of the system.
Such exposure increases the risk of further attacks, unauthorized access, and compromise of the affected environment.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves unauthorized access to the /splunkd/__raw/servicesNS/-/-/configs/conf-passwords REST API endpoint by low-privileged users. Detection would involve monitoring access attempts to this specific REST API endpoint.
However, no specific detection commands or tools are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The only mitigation available is to upgrade affected Splunk Enterprise and Splunk Cloud Platform versions to fixed releases.
- Upgrade Splunk Enterprise to version 10.2.0, 10.0.3, 9.4.9, 9.3.10 or higher.
- Upgrade Splunk Cloud Platform to versions 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, 9.3.2411.123 or higher.
No other mitigations or workarounds are available according to the advisory.