Loading vulnerability…
Privilege misuse via CSRF on Splunk /services/streams/search risky command execution
CVE-2025-20226 is a vulnerability in Splunk Enterprise and Splunk Cloud Platform that affects Splunk Enterprise versions before 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions before 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214. A low-privileged authenticated user without the admin or power roles can cause a saved search containing a risky command to run with the permissions of a higher-privileged user by abusing the /services/streams/search endpoint through its q parameter. This bypasses SPL safeguards intended to restrict execution of risky commands. Exploitation depends on tricking a higher-privileged victim into initiating a browser request, making the issue effectively a cross-site request forgery condition that results in privilege misuse and execution of restricted search functionality under another user's authority.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privileged user to bypass SPL protections for risky commands and execute a saved search using the effective permissions of a higher-privileged user. This can enable unauthorized command execution within the Splunk search context and actions that should be restricted to more privileged roles. The practical impact depends on what risky commands and search capabilities are available to the impersonated higher-privileged context, but it represents a privilege boundary bypass and unauthorized execution of restricted functionality.
If you can’t patch tonight, do this now.
Until patches are applied, reduce exposure by limiting access to Splunk web interfaces to trusted users and networks, minimizing the number of users with elevated Splunk roles, and enforcing anti-CSRF and browser-hardening controls where possible. Administrators should also restrict or review use of saved searches and risky commands, and monitor for unexpected execution of risky SPL operations initiated through browser-driven requests. Because exploitation requires victim interaction, user awareness and segregation of administrative browsing activity can also reduce risk.
Patch, then assume compromise.
Upgrade Splunk Enterprise to 9.4.1, 9.3.3, 9.2.5, or 9.1.8 or later, depending on the deployed branch. Upgrade Splunk Cloud Platform to 9.3.2408.107, 9.2.2406.111, or 9.1.2308.214 or later, as applicable. Apply the vendor security updates that correct the privilege handling and safeguard bypass on the affected search endpoint.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.