Loading vulnerability…
Splunk Stored Credential Hash Disclosure via REST SPL Command
CVE-2026-20298 is a sensitive information disclosure vulnerability in Splunk Enterprise and Splunk Cloud Platform. In affected releases, the REST SPL command can return the encr_password result field when querying the stored-passwords REST resource. This permits authenticated low-privileged users that lack the admin and power roles to retrieve stored credential hashes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthorized disclosure of stored credential hashes compromises sensitive authentication material. An attacker may use the hashes in offline password-cracking efforts and potentially obtain credentials that enable further access to Splunk resources or associated systems. Integrity and availability are not directly affected.
If you can’t patch tonight, do this now.
For Splunk Enterprise, set mask_encr_password = true in the [storage_passwords_masking] stanza of limits.conf and restart the Splunk Enterprise instance. Restrict assignment of low-privilege accounts and review use of the REST SPL command until fixed releases are deployed.
Patch, then assume compromise.
Upgrade Splunk Enterprise to 10.4.1, 10.2.5, 10.0.8, or 9.4.13 or later, according to the deployed maintenance branch. For Splunk Cloud Platform, upgrade to 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, or 10.1.2507.24 or later. Splunk Cloud Platform instances should be patched through Splunk-managed maintenance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.