Splunk Enterprise and Cloud Platform Vulnerability Affecting Low-Privileged Users

CVE-2025-20379

What is CVE-2025-20379?

In specific versions of Splunk Enterprise and Splunk Cloud Platform, a vulnerability enables low-privileged users to execute saved searches with potentially harmful commands by leveraging the permissions of higher-privileged users. This occurs through the 'q' parameter on the '/services/streams/search' endpoint, where an attacker can exploit character encoding to evade endpoint restrictions. While the attack requires the authenticated user's cooperation through phishing, it poses a significant security risk due to the potential for unauthorized command execution.

References