Splunk fixes flaws exposing internal data and enabling denial of service

Splunk released patches for three vulnerabilities affecting Splunk Enterprise, Splunk Cloud Platform, and the Splunk AI Toolkit, including a high-severity denial-of-service bug and two issues that can expose sensitive data. CVE-2026-20240 affects the splunk_archiver app, where a low-privileged user can abuse the coldToFrozen.sh script to rename critical directories and render an instance inoperable. CVE-2026-20239 stems from improper output sanitization in the TcpChannel component and can leak session cookies and cleartext HTTP response bodies into the _internal log index, while CVE-2026-20238 is an access-control weakness in the Splunk AI Toolkit that can bypass intended search restrictions and expose restricted data.

Splunk said the issues were fixed in updated releases, including AI Toolkit 5.7.3 for CVE-2026-20238, and urged customers to upgrade affected deployments. The company also published interim mitigations for organizations that cannot patch immediately, including restricting access to the _internal index to administrators, disabling the Splunk Archiver application, reviewing inherited roles and permissions, and removing the problematic srchFilter entry from local configuration where applicable. The advisories highlight risks to both platform availability and the confidentiality of operational data stored in Splunk environments.