PT-2026-20470 · Splunk · Splunk Enterprise+1
Fredrik Alexandersson
+1
·
Publicado
2026-02-18
·
Atualizado
2026-02-24
·
CVE-2026-20139
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Splunk Enterprise versions prior to 10.2.0
Splunk Enterprise versions 10.0.2 through 10.0.2
Splunk Enterprise versions 9.2.12 through 9.4.8
Splunk Enterprise versions 9.3.9
Splunk Cloud Platform versions prior to 10.2.2510.3
Splunk Cloud Platform versions 10.0.2503.9 through 10.1.2507.8
Splunk Cloud Platform versions 9.3.2411.121
Description
A user with limited privileges, lacking 'admin' or 'power' roles in Splunk, can create a malicious payload within the
realname, tz, or email parameters of the /splunkd/ raw/services/authentication/users/username REST API endpoint when changing a password. This could potentially cause a client-side denial-of-service (DoS), significantly slowing page load times or causing Splunk Web to become temporarily unresponsive. The API endpoint is /splunkd/ raw/services/authentication/users/username. The vulnerable parameters are realname, tz, and email.Recommendations
Update Splunk Enterprise to version 10.2.0 or later.
Update Splunk Enterprise to version 10.0.2 or later.
Update Splunk Enterprise to version 9.4.8 or later.
Update Splunk Enterprise to version 9.3.9 or later.
Update Splunk Enterprise to version 9.2.12 or later.
Update Splunk Cloud Platform to version 10.2.2510.3 or later.
Update Splunk Cloud Platform to version 10.1.2507.8 or later.
Update Splunk Cloud Platform to version 10.0.2503.9 or later.
Update Splunk Cloud Platform to version 9.3.2411.121 or later.
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Splunk Cloud Platform
Splunk Enterprise