Cross-Site Request Forgery Vulnerability in Splunk Enterprise and Cloud Platform

CVE-2025-20321

What is CVE-2025-20321?

In versions of Splunk Enterprise and Splunk Cloud Platform prior to the specified versions, an unauthenticated attacker can exploit a Cross-Site Request Forgery vulnerability. This security flaw allows the attacker to send a specially-crafted SPL search that may alter the membership state within a Splunk Search Head Cluster. The attack is reliant on social engineering tactics, requiring the administrator-level victim to initiate a request unknowingly. This could result in the unauthorized removal of cluster members or the captain, compromising the integrity of the Splunk environment.

References