Critical

Improper Certificate Validation in Splunk Enterprise and Splunk Cloud Platform Python HTTP Libraries

IdentifiersCVE-2022-32151CWE-295· Improper Certificate Validation

CVE-2022-32151 is an improper certificate validation vulnerability in Splunk Enterprise before version 9.0 and Splunk Cloud Platform before version 8.2.2203. The Python httplib and urllib libraries shipped with these products did not validate TLS certificates against certificate authority trust stores by default. As a result, outbound or inter-component HTTPS connections made through these libraries could accept untrusted or spoofed server certificates. Python 3 client libraries were later changed to verify server certificates by default and to use the appropriate CA certificate stores for each library. Applications and add-ons that bundle and use their own HTTP libraries are not affected.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow a man-in-the-middle or protocol impersonation attack against affected Splunk communications that rely on the vulnerable Python libraries. An attacker positioned on the network path, or otherwise able to present a spoofed endpoint, could intercept and manipulate data transmitted over supposedly protected channels, undermining confidentiality and integrity. In Splunk deployments, this could expose sensitive operational data and may enable unauthorized actions in affected communication flows.

Mitigation

If you can’t patch tonight, do this now.

Where immediate upgrade is not possible, reduce exposure by enforcing strict TLS certificate validation and host name validation for Splunk-to-Splunk communications, ensuring trusted CA stores are correctly configured, and limiting opportunities for network-path interception. Review Splunk configurations related to server certificate verification and TLS validation behavior to ensure certificate checks are not disabled.

Remediation

Patch, then assume compromise.

For Splunk Enterprise, upgrade to version 9.0 or later and enable TLS host name validation for Splunk-to-Splunk communications. For Splunk Cloud Platform, use version 8.2.2203 or later. The remediation also includes the change in Python 3 client library behavior so that server certificates are verified by default against appropriate CA certificate stores.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

SplunkSplunkapplication

SplunkSplunk Cloud Platformapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

splunk researchNews

May 14, 2026

Detection: Splunk Digital Certificates Lack of Encryption | Splunk Security Content

A Splunk vulnerability associated with forwarder connections lacking TLS encryption, which could expose sensitive data and potentially allow attackers to download or publish forwarder bundles, leading to arbitrary code execution.

splunk researchNews

May 14, 2026

Detection: Splunk Protocol Impersonation Weak Encryption Configuration | Splunk Security Content

A Splunk vulnerability related to weak encryption / improper TLS validation configuration in Python httplib and urllib usage that could enable protocol impersonation attacks and unauthorized access to Splunk environments.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2022-32151

NVD

nvd.nist.gov/vuln/detail/CVE-2022-32151

MITRE CWE · CWE-295

Improper Certificate Validation

Vendor Advisory

docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation

Vendor Advisory

docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates

Vendor Advisory

research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_simplerequest

Vendor Advisory

splunk.com/en_us/product-security/announcements/svd-2022-0601.html

Improper Certificate Validation in Splunk Enterprise and Splunk Cloud Platform Python HTTP Libraries

IdentifiersCVE-2022-32151CWE-295· Improper Certificate Validation