High

Improper TLS Certificate Validation in Splunk-to-Splunk Communications

IdentifiersCVE-2022-32152CWE-295· Improper Certificate Validation

CVE-2022-32152 is an improper certificate validation vulnerability affecting Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. By default, affected Splunk peer-to-peer communications did not validate TLS certificates correctly, including missing hostname validation during Splunk-to-Splunk communications. As a result, connections from misconfigured nodes without valid certificates did not fail by default. Properly configured peer communications using valid certificates were not vulnerable. The issue also manifested in Splunk Python client library behavior where SSL certificate validation could be enabled without hostname verification, creating conditions for protocol impersonation and man-in-the-middle attacks.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An attacker able to position themselves in the communication path, or otherwise exploit acceptance of invalid peer certificates, could impersonate a trusted Splunk peer and intercept or alter data exchanged between Splunk components. This can undermine the confidentiality and integrity of Splunk-to-Splunk communications and may enable unauthorized access to operational data, manipulation of telemetry or search-related traffic, and broader compromise of trust relationships within the Splunk environment. The available information indicates the primary impact is man-in-the-middle exposure rather than direct unauthenticated remote code execution.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrading is not possible, reduce exposure by enforcing proper TLS configuration for all Splunk peer communications, requiring valid certificates signed by a trusted authority, and enabling hostname validation wherever supported. Remove or replace insecure default or self-signed certificates where they are not explicitly trusted, audit peer definitions for nodes added without valid certificates, and restrict administrative access to prevent unauthorized peer enrollment. Network segmentation and protection of Splunk management and inter-node channels can further reduce man-in-the-middle risk.

Remediation

Patch, then assume compromise.

For Splunk Enterprise, upgrade to Splunk Enterprise 9.0 or later. For Splunk Cloud Platform, upgrade to version 8.2.2203 or later. After upgrading, configure TLS hostname validation for Splunk-to-Splunk communications and ensure peer communications use valid certificates. Splunk deployments should also ensure Splunk Python modules and related client components enforce certificate and hostname validation as part of TLS configuration.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

SplunkSplunkapplication

SplunkSplunk Cloud Platformapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

splunk researchNews

May 14, 2026

Detection: Splunk protocol impersonation weak encryption selfsigned | Splunk Security Content

A Splunk vulnerability associated with insecure default configuration involving weak encryption and default self-signed certificates, which could enable protocol impersonation and man-in-the-middle style risks.

splunk researchNews

May 14, 2026

Detection: Splunk protocol impersonation weak encryption simplerequest | Splunk Security Content

An improper SSL/TLS certificate validation vulnerability in Splunk Python3 client libraries where certificate validation can occur without hostname verification, enabling man-in-the-middle risk.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2022-32152

NVD

nvd.nist.gov/vuln/detail/CVE-2022-32152

MITRE CWE · CWE-295

Improper Certificate Validation

Vendor Advisory

docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation

Vendor Advisory

docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates

Vendor Advisory

research.splunk.com/application/splunk_digital_certificates_infrastructure_version

Vendor Advisory

research.splunk.com/application/splunk_digital_certificates_lack_of_encryption

Vendor Advisory

research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_selfsigned

Vendor Advisory

research.splunk.com/network/splunk_identified_ssl_tls_certificates

Vendor Advisory

splunk.com/en_us/product-security/announcements/svd-2022-0602.html

Improper TLS Certificate Validation in Splunk-to-Splunk Communications

IdentifiersCVE-2022-32152CWE-295· Improper Certificate Validation