Loading vulnerability…
Privilege misuse and sensitive information disclosure in Splunk Enterprise and Splunk Secure Gateway
CVE-2025-20231 is a vulnerability in Splunk Enterprise and the Splunk Secure Gateway app affecting Splunk Enterprise versions before 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Secure Gateway versions before 3.8.38 and 3.7.23 on Splunk Cloud Platform. Due to improper permission settings, a low-privileged authenticated user without the Splunk admin or power roles can cause a search to execute using the permissions of a higher-privileged user. This can result in unauthorized disclosure of sensitive information. Available reporting also indicates that, in the Splunk Secure Gateway context, session data and authentication tokens may be logged in plaintext during certain REST API interactions, increasing the sensitivity of exposed data. Exploitation is not fully attacker-driven and requires social engineering to induce a victim to initiate a browser request.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated low-privileged attacker to access data that should be restricted to higher-privileged users. The primary impact is confidentiality loss through unauthorized search execution and exposure of sensitive information. Depending on the accessible data and deployment context, this may include operational data, user session information, or authentication material associated with affected Secure Gateway functionality.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the Splunk Secure Gateway app where operationally feasible. Reduce exposure by limiting access for low-privileged accounts, reviewing role assignments, and minimizing opportunities for browser-based request forgery or phishing against privileged users until fixed versions are deployed.
Patch, then assume compromise.
Upgrade Splunk Enterprise to 9.4.1, 9.3.3, 9.2.5, or 9.1.8 or later, as appropriate for the deployed branch. Upgrade Splunk Secure Gateway to 3.8.38 or 3.7.23 or later on affected Splunk Cloud Platform deployments. Apply the vendor security updates across all affected product branches to correct the permission handling flaw.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.