CVE-2026-20298

Analyzed Analyzed - Analysis Complete

Stored Credential Hash Exposure via REST Endpoint in Splunk Enterprise

Publication date: 2026-07-15

Last updated on: 2026-07-24

Assigner: Cisco Systems, Inc.

Description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could view stored credential hashes when they access the `/servicesNS/-/-/storage/passwords` REST endpoint through the `|rest` Search Processing Language (SPL) command.<br><br>The exposure happens because the `|rest` SPL command returns the `encr_password` field in the results of the `/servicesNS/-/-/storage/passwords` REST endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-24

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-20298

EUVD

EUVD-2026-44738

Affected Vendors & Products

Vendor	Product	Version / Range
splunk	splunk	From 10.0.0 (inc) to 10.0.8 (exc)
splunk	splunk	From 10.2.0 (inc) to 10.2.5 (exc)
splunk	splunk	From 9.4.0 (inc) to 9.4.13 (exc)
splunk	splunk	10.4.0
splunk	splunk_cloud_platform	From 10.1.2507 (inc) to 10.1.2507.24 (exc)
splunk	splunk_cloud_platform	From 10.2.2510 (inc) to 10.2.2510.18 (exc)
splunk	splunk_cloud_platform	From 10.3.2512 (inc) to 10.3.2512.15 (exc)
splunk	splunk_cloud_platform	From 10.4.2604 (inc) to 10.4.2604.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Splunk Enterprise and Splunk Cloud Platform. A low-privileged user without admin or power roles can access stored credential hashes by querying the /servicesNS/-/-/storage/passwords endpoint using the |rest SPL command. The encr_password field is exposed in the results, leading to sensitive information disclosure.

Detection Guidance

To detect this vulnerability, check if low-privileged users can access the /servicesNS/-/-/storage/passwords endpoint via the |rest SPL command and view the encr_password field. No specific detection commands are provided in the resources.

Impact Analysis

An attacker with low privileges could steal stored credential hashes, potentially gaining unauthorized access to sensitive systems or data. This could lead to further compromise of user accounts or services relying on those credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Splunk Enterprise to versions 10.4.1, 10.2.5, 10.0.8, or 9.4.13 and Splunk Cloud Platform to versions 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, or 10.1.2507.24. Alternatively, set mask_encr_password = true in the limits.conf file under the [storage_passwords_masking] stanza and restart the Splunk instance.

Hi! I’m here to help you understand CVE-2026-20298. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70