Splunk fixes high-severity flaws enabling RCE and token exposure

Splunk released security updates for Splunk Enterprise, Splunk Cloud Platform, and Splunk Secure Gateway to address eight vulnerabilities, including two high-severity issues. The most serious flaw, CVE-2025-20229, can allow authenticated remote code execution through unauthorized file upload and execution, while CVE-2025-20231 can expose sensitive data because session data and authentication tokens may be logged in plaintext and protected with improper permissions. Splunk documentation for managing app and add-on objects is relevant because the attack surface includes application components and uploaded objects within Splunk environments.

The update also fixes several medium-severity weaknesses, including CSRF, an SPL security bypass with command execution, unauthorized access to sensitive data, and unauthorized system changes. Splunk further remediated vulnerabilities in bundled third-party components including idna, certifi, requests, urllib3, cryptography, axios, and Jinja2. Organizations using affected versions have been urged to upgrade promptly, and exposure from CVE-2025-20231 can also be reduced by disabling the Splunk Secure Gateway App until patches are applied.