CVE-2025-20366: Improper Access Control in Background Job Submission in Splunk Enterprise
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privileged user that does not hold the admin or power Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job in the background. If the low privileged user guesses the search job’s unique Search ID (SID), the user could retrieve the results of that job, potentially exposing sensitive search results. For more information see https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-jobs/about-jobs-and-job-management and https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-jobs/manage-search-jobs.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-20366?
CVE-2025-20366 is considered a low-severity vulnerability affecting certain versions of Splunk Enterprise and Splunk Cloud Platform.
How do I fix CVE-2025-20366?
To fix CVE-2025-20366, upgrade to Splunk Enterprise version 9.4.4 or later, or 9.3.6 or later, or Splunk Cloud Platform version 9.3.2411.111 or later.
Who is affected by CVE-2025-20366?
CVE-2025-20366 affects low-privileged users in Splunk Enterprise and Splunk Cloud Platform running specified versions.
What type of data is exposed in CVE-2025-20366?
CVE-2025-20366 allows low-privileged users to access sensitive search results they should not be able to view.
Is there a workaround for CVE-2025-20366?
Currently, there is no official workaround for CVE-2025-20366; upgrading to a patched version is the recommended solution.