Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the `integrationKey`, `secretKey`, and `appSecretKey` secrets, generated by [Duo Two-Factor Authentication for Splunk Enterprise](https://duo.com/docs/splunk), in plain text.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-20138 In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to … https://www.cve.org/CVERecord?id=CVE-2026-20138
Post summary
The text references CVE‑2026‑20138 for certain Splunk Enterprise versions but offers no substantive details beyond affected releases and a brief role description.
🚨*CVE* CVE-2026-20138 In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to … https://www.cve.org/CVERecord?id=CVE-2026-20138 ----- Traducción: CVE-2026-20138 En … http://infoflow.cloud`
Post summary
The post cites CVE‑2026‑20138 affecting specific Splunk Enterprise versions but provides no evidence of exploitation, PoC, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | splunk | splunk | - | - | - |