Loading vulnerability…
CSRF-Based SPL Command Safeguards Bypass in Splunk Deployment Server
CVE-2026-20296 is a cross-site request forgery and SPL command safeguards bypass vulnerability in Deployment Server functionality within Splunk Web. Deployment Server endpoints do not validate CSRF tokens on GET requests and do not correctly neutralize caller-controlled input before incorporating it into Search Processing Language (SPL) searches. An unauthenticated attacker can trick a user with the list_deployment_server capability into initiating a crafted browser request, causing arbitrary SPL searches to execute as splunk-system-user and potentially exposing stored credentials and indexed data. Affected releases include Splunk Enterprise 10.4.0, 10.2.0–10.2.4, 10.0.0–10.0.7, and 9.4.0–9.4.12, and Splunk Cloud Platform releases below the respective fixed versions 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses SPL command safeguards and permits unauthorized searches in the privileged splunk-system-user context. This can expose stored credentials and indexed data. The vulnerability is rated High with a CVSS v3.1 score of 8.3, reflecting high confidentiality and integrity impact and limited availability impact. Operating-system command execution is not established.
If you can’t patch tonight, do this now.
If an immediate upgrade is not possible, disable Splunk Web where it is not needed. Review role assignments and restrict the list_deployment_server capability to users who require it; this reduces exposure but does not correct the underlying vulnerability.
Patch, then assume compromise.
Upgrade Splunk Enterprise to 10.4.1, 10.2.5, 10.0.8, or 9.4.13, or a later fixed release in the applicable branch. For Splunk Cloud Platform, ensure the instance has received the applicable fixed release: 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, or 10.1.2507.24, or later. Splunk is responsible for patching affected Cloud Platform instances.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.