Access Control Flaw in Splunk Enterprise and Cloud Platform
CVE-2026-20165

6.3MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Splunk Cloud Platform
Vendor
CVE Published:
11 March 2026

What is CVE-2026-20165?

In Splunk Enterprise and Splunk Cloud Platform, a vulnerability has been identified that allows low-privileged users without 'admin' or 'power' roles to access sensitive information from job search logs. This occurs due to inadequate access control in the MongoClient logging channel, potentially exposing critical data to unauthorized users. Appropriate measures should be taken to update affected products to restore secure access controls.

Affected Version(s)

Splunk Cloud Platform 10.2.2510 < 10.2.2510.7

Splunk Cloud Platform 10.1.2507 < 10.1.2507.17

Splunk Cloud Platform 10.0.2503 < 10.0.2503.12

References

https://advisory.splunk.com/advisories/SVD-2026-0304

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

John Copeland
.