Loading vulnerability…
CSRF in Splunk App Key Value Store maintenance mode
CVE-2025-20228 is a cross-site request forgery vulnerability affecting Splunk Enterprise before 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform before 9.2.2403.108 and 9.1.2312.204. The flaw allows a low-privileged authenticated user who does not have the admin or power roles to change the maintenance mode state of the App Key Value Store (KVStore) by causing a forged request to be processed in the context of an authenticated session. The issue results from insufficient protection against unauthorized state-changing requests in the web application workflow handling KVStore maintenance mode changes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to perform unauthorized administrative-style state changes to the App Key Value Store by toggling its maintenance mode despite lacking the required higher-privilege roles. This can disrupt normal KVStore availability or operations and may interfere with applications or platform features that depend on KVStore functionality.
If you can’t patch tonight, do this now.
Until patches are applied, reduce exposure to CSRF by restricting access to the Splunk web interface, enforcing strong session hygiene, and limiting the ability of low-privileged users to access affected administrative workflows where operationally feasible. Standard browser-based CSRF defenses such as anti-CSRF validation and minimizing authenticated browsing to untrusted sites also reduce risk, but vendor fixes are the primary mitigation.
Patch, then assume compromise.
Upgrade Splunk Enterprise to 9.3.3, 9.2.5, 9.1.8, or a later fixed release, and upgrade Splunk Cloud Platform to 9.2.2403.108, 9.1.2312.204, or a later fixed release. Apply the vendor security updates across all affected deployments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.