Loading vulnerability…
Improper access control in Splunk Secure Gateway KVStore collections
CVE-2025-20230 is an improper access control vulnerability affecting Splunk Enterprise before 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Secure Gateway on Splunk Cloud Platform before 3.8.38 and 3.7.23. The flaw affects App Key Value Store (KVStore) collections created by Splunk Secure Gateway. Due to missing access control and incorrect ownership assignment, data in the affected KVStore collections was owned by the generic nobody user rather than by a specific user. As a result, a low-privileged authenticated user without the Splunk admin or power roles could edit or delete data belonging to other users within those collections.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated low-privileged user to perform unauthorized modification or deletion of other users' data stored in affected Splunk Secure Gateway KVStore collections. This compromises data integrity within the application and can enable unauthorized system changes through manipulation of application-managed data.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to Splunk Secure Gateway and limit assignment of low-privileged accounts that can interact with the affected KVStore-backed functionality. Review role permissions and reduce exposure of features that permit modification of Secure Gateway-managed data until fixed versions are deployed. Definitive mitigation requires upgrading to a remediated release.
Patch, then assume compromise.
Upgrade Splunk Enterprise to 9.4.1, 9.3.3, 9.2.5, or 9.1.8 or later, and upgrade Splunk Secure Gateway on Splunk Cloud Platform to 3.8.38, 3.7.23, or later. Applying the vendor-fixed versions corrects the missing access control and improper ownership behavior in the affected KVStore collections.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.