CVE-2026-20296
Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Request Forgery in Splunk Enterprise

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: Cisco Systems, Inc.

Description
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for access to stored credentials and indexed data.<br><br>The vulnerability is possible because Deployment Server endpoints in Splunk Web do not validate Cross-Site Request Forgery (CSRF) tokens on GET requests, and caller-supplied input is not correctly neutralized before it is placed into an SPL search.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-07-15
AI Q&A
2026-07-15
EPSS Evaluated
N/A
NVD
CVE-2026-20296
EUVD
EUVD-2026-44737

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
splunk splunk_enterprise to 10.4.1 (exc)
splunk splunk_cloud_platform to 10.5.2605.0 (exc)
splunk splunk_enterprise to 9.4.13 (exc)
splunk splunk_cloud_platform to 10.1.2507.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to trick a user with the list_deployment_server capability into running arbitrary SPL searches on their behalf. The attacker exploits a CSRF flaw in Deployment Server endpoints that do not validate tokens on GET requests, enabling access to stored credentials and indexed data.

Impact Analysis

An attacker could gain access to sensitive data like stored credentials and indexed information by tricking a user into clicking a malicious link. This requires the victim to have the list_deployment_server capability and be phished into initiating the request.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements like GDPR or HIPAA. Unauthorized access to stored credentials or indexed data may result in data breaches, triggering regulatory penalties.

Detection Guidance

To detect this vulnerability, check Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, or Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24. Review Splunk Web logs for unusual SPL search requests or CSRF token validation failures.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.1, 10.2.5, 10.0.8, or 9.4.13, or Splunk Cloud Platform to the specified patched versions. As a temporary measure, disable Splunk Web until patching is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20296. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart