CVE-2025-20371
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119, and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF), potentially allowing REST API calls on behalf of an authenticated high-privileged user.
Risk Assessment
An attacker could exploit SSRF to perform actions on behalf of a privileged user, potentially leading to unauthorized data access or configuration changes. The risk applies to unpatched Splunk installations.
Recommendation
Update Splunk Enterprise or Splunk Cloud Platform to a version containing the fix (10.0.1, 9.4.4, 9.3.6, 9.2.8, or corresponding newer cloud version). Monitor for unusual API requests.
Other vulnerabilities in Splunk
See all- CVE-2013-7394High
The 'runshellscript echo.sh' script in Splunk before version 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted string.
- CVE-2026-20298Medium
In Splunk Enterprise and Splunk Cloud Platform, a vulnerability allows a low-privileged user (without 'admin' or 'power' roles) to view stored credential hashes. This occurs when the user accesses the `/servicesNS/-/-/storage/passwords` REST endpoint via the `|rest` SPL command, which returns the `encr_password` field.
- CVE-2026-20297High
In Splunk Enterprise and Splunk Cloud Platform, a path traversal vulnerability exists in the app installation workflow. A user with `edit_local_apps` and `install_apps` capabilities can write files outside the intended app directory into `$SPLUNK_HOME/etc/` and its subdirectories.
- CVE-2026-20296High
In Splunk Enterprise and Splunk Cloud Platform, a CSRF vulnerability allows an attacker to trick a user with appropriate privileges into executing arbitrary SPL searches as the splunk-system-user. The issue is due to missing CSRF token validation on GET requests in Deployment Server endpoints and improper input neutralization before inclusion in an SPL search.
- CVE-2026-20240Medium
In Splunk Enterprise before versions 10.2.2, 10.0.5, 9.4.11, 9.3.12 and Splunk Cloud Platform before specified versions, a low-privileged user (without admin or power roles) can cause a denial of service (DoS) by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.
- CVE-2026-20239High
Vulnerability in Splunk Enterprise (versions below 10.2.2 and 10.0.5) and Splunk Cloud Platform (multiple versions) allows users with access to the _internal index to view session cookies and response bodies containing sensitive data.
- CVE-2025-20384Medium
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject ANSI escape codes into Splunk log files due to improper validation at the /en-US/static/ web endpoint.
- CVE-2025-20369Medium
In Splunk Enterprise and Splunk Cloud Platform, a low-privilege user without the admin or power roles can perform an XML external entity (XXE) injection through the dashboard tab label field. The XXE injection can cause denial of service (DoS) attacks.
Original NVD description (English source)
In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS