Blind SSRF in Splunk Enterprise and Splunk Cloud Platform

CVE-2025-20371 is a blind server-side request forgery vulnerability in Splunk Enterprise and Splunk Cloud Platform. In affected versions, Splunk processes certain REST API calls in a way that does not adequately validate or restrict user-controlled URLs or related parameters, allowing an unauthenticated attacker to cause the Splunk server to issue arbitrary HTTP requests to attacker-chosen destinations. The issue is described as blind SSRF because the attacker does not directly receive the response body, but can still induce server-side interactions with internal or external services. Under the documented exploitation conditions, the forged requests may be performed in the context of an authenticated high-privileged user, potentially enabling REST API actions through Splunk on that user’s behalf.