Sensitive Data Exposure in Splunk Enterprise and Cloud Platform

CVE-2025-20325

What is CVE-2025-20325?

In specific versions of Splunk Enterprise and Splunk Cloud Platform, a sensitive data exposure occurs when the search head cluster key is potentially exposed. This vulnerability arises from running the SHCConfig log channel at the DEBUG logging level in a clustered deployment. If this logging level is configured, sensitive information may be accessible if an attacker has local access to log files or administrative rights to internal indexes—access typically restricted to admin roles. It's essential for users to review their instance's roles and capabilities, ensuring that access to internal indexes is limited to user roles with the necessary permissions.

References