CVE-2026-20298

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.5 Splunk Enterprise versions prior to 10.0.8 Splunk Enterprise versions prior to 9.4.13 Splunk Cloud Platform versions prior to 10.5.2605.0 Splunk Cloud Platform versions prior to 10.4.2604.6 Splunk Cloud Platform versions prior to 10.3.2512.15 Splunk Cloud Platform versions prior to 10.2.2510.18 Splunk Cloud Platform versions prior to 10.1.2507.24

Description A low-privileged user without 'admin' or 'power' roles can view stored credential hashes. This occurs when accessing the '/servicesNS/-/-/storage/passwords' REST endpoint using the |rest Search Processing Language (SPL) command, as the command returns the encr password field in the results.

Recommendations Update Splunk Enterprise to version 10.4.1 or later. Update Splunk Enterprise to version 10.2.5 or later. Update Splunk Enterprise to version 10.0.8 or later. Update Splunk Enterprise to version 9.4.13 or later. Update Splunk Cloud Platform to version 10.5.2605.0 or later. Update Splunk Cloud Platform to version 10.4.2604.6 or later. Update Splunk Cloud Platform to version 10.3.2512.15 or later. Update Splunk Cloud Platform to version 10.2.2510.18 or later. Update Splunk Cloud Platform to version 10.1.2507.24 or later. Restrict access to the '/servicesNS/-/-/storage/passwords' REST endpoint to prevent unauthorized users from accessing the encr password field.