PT-2026-24737 · Splunk · Splunk Cloud Platform+2

John Copeland · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-20165

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.1 Splunk Enterprise versions 10.0.0 through 10.0.4 Splunk Enterprise versions 9.3.10 and earlier Splunk Enterprise version 9.4.9 Splunk Cloud Platform versions prior to 10.2.2510.7 Splunk Cloud Platform versions 10.0.2503.12 and earlier Splunk Cloud Platform versions 10.1.2507.17 and earlier Splunk Cloud Platform versions 9.3.2411.124 and earlier

Description A user with limited privileges, lacking the 'admin' or 'power' roles within Splunk, may be able to access sensitive information by examining the search log of a job. This is due to insufficient access controls within the MongoClient logging channel. The issue involves improper access control, allowing unauthorized information disclosure.

Recommendations Update Splunk Enterprise to version 10.2.1 or later. Update Splunk Enterprise to version 10.0.4 or later. Update Splunk Enterprise to version 9.4.9 or later. Update Splunk Enterprise to version 9.3.10 or later. Update Splunk Cloud Platform to version 10.2.2510.7 or later. Update Splunk Cloud Platform to version 10.1.2507.17 or later. Update Splunk Cloud Platform to version 10.0.2503.12 or later. Update Splunk Cloud Platform to version 9.3.2411.124 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-20165

Affected Products

Splunk Cloud Platform

Splunk Enterprise

Splunk

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-20165 · Security Note
• https://advisory.splunk.com/advisories/SVD-2026-0304 · Vendor Advisory
• https://t.me/CVEtracker/47144 · Telegram Post
• https://twitter.com/CVEnew/status/2032998306310135996 · Twitter Post