# CVE-2026-20296: Splunk Enterprise CSRF and SPL injection in Deployment Server

Source: https://junglewise.ai/threats/cve-2026-20296-splunk-enterprise-csrf-and-spl-injection-in-deployment-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-20296 · Severity: high · CVSS 8.3 · Published 2026-07-15

Splunk Enterprise and Splunk Cloud Platform are data analysis platforms used for monitoring and searching large datasets. A security flaw in the Deployment Server component could allow an attacker to trick an authorized user into unknowingly running malicious searches. If successful, this could allow the attacker to steal stored credentials and access sensitive indexed data, potentially compromising the entire monitoring environment.

Technologies: [Splunk Enterprise](https://junglewise.ai/threats/technologies/splunk-enterprise), [Splunk Cloud Platform](https://junglewise.ai/threats/technologies/cloud-platform). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-20296 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20296 being exploited in the wild.

**How severe is CVE-2026-20296?** High severity, with a CVSS score of 8.3, published 15 July 2026.

**Which products and versions are affected?** Splunk Enterprise < 10.4.1, < 10.2.5, < 10.0.8, < 9.4.13; Splunk Cloud Platform < 10.5.2605.0, < 10.4.2604.7, < 10.3.2512.16, < 10.2.2510.18, < 10.1.2507.24.

**Is there a fix for CVE-2026-20296?** A patch was published on 2026-07-15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20296 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20296?** Check whether you run Splunk Enterprise or Splunk Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Deployment Server endpoints of Splunk Web. The root cause is twofold: the application fails to validate CSRF tokens on GET requests and fails to neutralize caller-supplied input before incorporating it into Search Processing Language (SPL) queries. An unauthenticated remote attacker can exploit this by tricking a user with 'list_deployment_server' capabilities into visiting a malicious URL. This results in the execution of arbitrary SPL searches as the high-privileged 'splunk-system-user', enabling unauthorized access to credentials and indexed data. The issue is resolved in Splunk Enterprise versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, and various Splunk Cloud Platform maintenance releases.

## Affected products

- Splunk Splunk Enterprise < 10.4.1, < 10.2.5, < 10.0.8, < 9.4.13
- Splunk Splunk Cloud Platform < 10.5.2605.0, < 10.4.2604.7, < 10.3.2512.16, < 10.2.2510.18, < 10.1.2507.24

## Timeline

- 2026-07-15: disclosed
- 2026-07-15: advisory
- 2026-07-15: patched

## References

- [https://advisory.splunk.com/advisories/SVD-2026-0702](https://advisory.splunk.com/advisories/SVD-2026-0702)

## Related threats

- [Splunk Enterprise improper neutralization vulnerability](https://junglewise.ai/threats/cve-2026-76302-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise protection mechanism failure](https://junglewise.ai/threats/cve-2026-76301-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise improper resource control](https://junglewise.ai/threats/cve-2026-76300-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise improper access control](https://junglewise.ai/threats/cve-2026-76299-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Splunk Enterprise hardcoded cryptographic key in PostgreSQL sidecar](https://junglewise.ai/threats/cve-2026-76298-in-splunk-enterprise-versions-below-10-4-4-and-10-2-8-a-user-who)