CVE-2026-20137: Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise
In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122, a low-privileged user who does not hold the "admin" or "power" Splunk roles could bypass the SPL safeguards for risky commands when they create a Data Model that contains an injected SPL query within an object. They can bypass the safeguards by exploiting a path traversal vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20137?
CVE-2026-20137 is classified as a low-severity vulnerability affecting specified versions of Splunk products.
How do I fix CVE-2026-20137?
To fix CVE-2026-20137, upgrade to Splunk Enterprise version 10.2.0 or later, or Splunk Cloud Platform version 10.1.2507.0 or later.
Who is affected by CVE-2026-20137?
CVE-2026-20137 affects low-privileged users in Splunk Enterprise and Splunk Cloud Platform versions below the specified thresholds.
What are the impacted versions for CVE-2026-20137?
Impacted versions for CVE-2026-20137 include Splunk Enterprise versions below 10.2.0 and Splunk Cloud Platform versions below 10.1.2507.0.
What protections are bypassed due to CVE-2026-20137?
CVE-2026-20137 allows low-privileged users to bypass the SPL safeguards designed to control risky commands.