CVE-2026-20298Disclosure(splunk / splunk)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch splunk splunk systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could view stored credential hashes when they access the `/servicesNS/-/-/storage/passwords` REST endpoint through the `|rest` Search Processing Language (SPL) command.<br><br>The exposure happens because the `|rest` SPL command returns the `encr_password` field in the results of the `/servicesNS/-/-/storage/passwords` REST endpoint.

splunk CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://advisory.splunk.com/advisories/SVD-2026-0704

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

splunk
splunk_cloud_platform

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 1 signal
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-07-15); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

splunk

Products

splunksplunk_cloud_platform

1 version affected across 2 products

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

250.0%

Patch

250.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	2	Disclosure2
2026-07-16	2	Patch2

Full discourse4 posts

Daily CyberSecurity@Daily_CyberSec91d
Patch
Splunk patched three Splunk Enterprise vulnerabilities: CVE-2026-20296 CSRF, CVE-2026-20297 path traversal, and CVE-2026-20298 credential exposure. #Splunk #CVE202620296 #CSRF #Vulnerability #InfoSec http://securityonline.info/splunk-enterprise-vulnerabilities-cve-2026-20296/
Post summary
Splunk has released patches for three new vulnerabilities—CVE-2026-20296 (CSRF), CVE-2026-20297 (path traversal), and CVE-2026-20298 (credential exposure)—and announced the fix publicly.
02021409
12.9K followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-20298 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18,… https://www.cve.org/CVERecord?id=CVE-2026-20298
Post summary
The text offers a concise disclosure of CVE‑2026‑20298, listing affected Splunk and Splunk Cloud Platform versions without further technical or remediation detail.
00020707
58.1K followersView on X
The Daily Tech Feed@dailytechonx91d
Patch
Splunk has patched critical vulnerabilities in its Enterprise and Cloud Platform, including CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298. Users should update to versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, or later to mitigate these security risks. #Splunk #CyberSecurity #Vulnerability #SecurityUpdate #CVE202620296 #CVE202620297 #CVE202620298 https://thedailytechfeed.com/splunk-patches-critical-vulnerabilities-in-enterprise-platform/
Post summary
Splunk announced patches for CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298, advising users to update to specified versions to mitigate the vulnerabilities.
0000060
539 followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-20298 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18,… https://www.cve.org/CVERecord?id=CVE-2026-20298 ----- Traducción: CVE-2026-20298 En … http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑20298, lists vulnerable Splunk Enterprise and Cloud Platform version ranges, and links to the official CVE record, offering a basic disclosure without additional exploitation or remediation details.
0000031
92 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	splunk	splunk	-	-	-
App	splunk	splunk	10.4.0	-	-
App	splunk	splunk_cloud_platform	-	-	-

Explore more

Back to dashboard splunk CVEs splunk vulnerabilities

What researchers are saying

CVE-2026-20298

The Daily Tech Feed[verified]@dailytechonxPatch

Splunk announced patches for CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298, advising users to update to specified versions to mitigate the vulnerabilities.

Daily CyberSecurity@Daily_CyberSecPatch

Splunk has released patches for three new vulnerabilities—CVE-2026-20296 (CSRF), CVE-2026-20297 (path traversal), and CVE-2026-20298 (credential exposure)—and announced the fix publicly.

CVE@CVEnewDisclosure

The text offers a concise disclosure of CVE‑2026‑20298, listing affected Splunk and Splunk Cloud Platform versions without further technical or remediation detail.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑20298, lists vulnerable Splunk Enterprise and Cloud Platform version ranges, and links to the official CVE record, offering a basic disclosure without additional exploitation or remediation details.