Loading vulnerability…
Information Disclosure in Splunk Dashboard Studio External Content Warning
CVE-2025-20227 is an information disclosure vulnerability affecting Splunk Enterprise before 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform before 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208, and 9.1.2308.214. A low-privileged authenticated user who does not hold the admin or power Splunk roles can bypass the external content warning modal dialog in Dashboard Studio dashboards. By circumventing this warning mechanism, the user may gain access to sensitive information that should have been protected by the intended user-facing safeguard.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in unauthorized access to sensitive information exposed through external content embedded or referenced in Dashboard Studio dashboards. The issue enables authenticated low-privileged users to bypass an intended protection boundary and view information they should not be able to access through normal application behavior.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to Dashboard Studio dashboards to only trusted users, minimize assignment of low-privileged accounts that can access dashboards containing external content, and review dashboards for exposure of sensitive external content. Monitor for suspicious access patterns involving Dashboard Studio content until fixed versions are deployed. Specific vendor mitigation beyond upgrading is currently not available in the provided information.
Patch, then assume compromise.
Upgrade Splunk Enterprise to version 9.4.1, 9.3.3, 9.2.5, or 9.1.8 or later, depending on the deployed branch. Upgrade Splunk Cloud Platform to version 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208, 9.1.2308.214, or later, depending on the deployed branch. Applying the vendor-fixed release is the primary remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.