CVE-2026-20298: Splunk Enterprise and Cloud Platform information disclosure in REST API

CVE-2026-20298 · Severity: medium · CVSS 5.3 · Published 2026-07-15

Splunk Enterprise and Splunk Cloud Platform are data analysis platforms used for monitoring and searching machine-generated data. A vulnerability in these platforms allows users with low-level access to view encrypted credential hashes that should be restricted to administrators. This could allow an internal user to potentially gain unauthorized access to other integrated systems by attempting to crack these hashes.

Technologies: Splunk Cloud Platform. Vendors: Splunk.

Quick answers

Is CVE-2026-20298 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20298 being exploited in the wild.
How severe is CVE-2026-20298?
Medium severity, with a CVSS score of 5.3, published 15 July 2026.
Which products and versions are affected?
Splunk Cloud Platform < 10.5.2605.0, < 10.4.2604.6, < 10.3.2512.15, < 10.2.2510.18, < 10.1.2507.24.
Is there a fix for CVE-2026-20298?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20298 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-20298?
Check whether you run Splunk Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability (CWE-200) exists in the Splunk REST API. Low-privileged users without 'admin' or 'power' roles can use the '|rest' Search Processing Language (SPL) command to query the '/servicesNS/-/-/storage/passwords' endpoint. The vulnerability is caused by the command incorrectly returning the 'encr_password' field in the results. An attacker with network access and valid low-privileged credentials can exploit this to obtain encrypted password hashes. Fixes involve upgrading to patched versions and, for Enterprise users, enabling 'mask_encr_password = true' in the limits.conf file.

Affected products

  • Splunk Splunk Enterprise < 10.4.1, < 10.2.5, < 10.0.8, < 9.4.13
  • Splunk Splunk Cloud Platform < 10.5.2605.0, < 10.4.2604.6, < 10.3.2512.15, < 10.2.2510.18, < 10.1.2507.24

Timeline

  • 2026-07-15: disclosed
  • 2026-07-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.