CVE-2026-20165
Last modified
CVE-2026-20165 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9.3.2411.124, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve sensitive information by inspecting the job's search log due to improper access control in the MongoClient logging channel.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9.3.2411.124, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve sensitive information by inspecting the job's search log due to improper access control in the MongoClient logging channel.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk | >= 9.3.0, < 9.3.10 |
| Splunk | Splunk | >= 9.4.0, < 9.4.9 |
| Splunk | Splunk | >= 10.0.0, < 10.0.4 |
| Splunk | Splunk | 10.2.0 |
| Splunk | Splunk Cloud Platform | >= 9.3.2411, < 9.3.2411.124 |
| Splunk | Splunk Cloud Platform | >= 10.0.2503, < 10.0.2503.12 |
| Splunk | Splunk Cloud Platform | >= 10.1.2507, < 10.1.2507.17 |
| Splunk | Splunk Cloud Platform | >= 10.2.2510, < 10.2.2510.7 |
References
- https://advisory.splunk.com/advisories/SVD-2026-0304Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-20165?
How severe is CVE-2026-20165?
How do I fix CVE-2026-20165?
Are you affected by CVE-2026-20165?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST