PT-2026-48492 · Splunk · Splunk Cloud Platform+1

Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-20252

Mitre

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could send server-side requests to arbitrary internal destinations through the Dashboard Studio PDF export feature.

The vulnerability exists because the trusted-domain validation uses a prefix match that can be bypassed with attacker-controlled subdomains (for example, docs.splunk.com.evil.com), and because the PDF export service follows HTTP redirects automatically without re-validating each redirect target against the allowlist.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-20252

Affected Products

Splunk Cloud Platform

Splunk Enterprise

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-20252 · Security Note
• https://advisory.splunk.com/advisories/SVD-2026-0602 · Note