Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-20298

Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisco

Description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could view stored credential hashes when they access the `/servicesNS/-/-/storage/passwords` REST endpoint through the `|rest` Search Processing Language (SPL) command.<br><br>The exposure happens because the `|rest` SPL command returns the `encr_password` field in the results of the `/servicesNS/-/-/storage/passwords` REST endpoint.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Splunk Splunk Enterprise

  • 10.4 to < 10.4.1affected
  • 10.2 to < 10.2.5affected
  • 10.0 to < 10.0.8affected
  • 9.4 to < 9.4.13affected

Splunk Splunk Cloud Platform

  • 10.5.2605 to < 10.5.2605.0affected
  • 10.4.2604 to < 10.4.2604.6affected
  • 10.3.2512 to < 10.3.2512.15affected
  • 10.2.2510 to < 10.2.2510.18affected
  • 10.1.2507 to < 10.1.2507.24affected

References