CVE-2026-20141: Improper Access Control in Splunk Monitoring Console App
In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin" Splunk role could access the Splunk Monitoring Console App endpoints due to an improper access control. This could lead to a sensitive information disclosure.<br><br>The Monitoring Console app is a bundled app that comes with Splunk Enterprise. It is not available for download on SplunkBase, and is not installed on Splunk Cloud Platform instances. This vulnerability does not affect Cloud Monitoring Console.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20141?
The severity of CVE-2026-20141 is classified as low, indicating a lower risk of exploitation.
How do I fix CVE-2026-20141?
To fix CVE-2026-20141, upgrade to Splunk Enterprise versions 10.0.2, 10.0.3, 9.4.8, or 9.3.9 or later.
What does CVE-2026-20141 exploit?
CVE-2026-20141 exploits improper access control allowing low-privileged users to access sensitive endpoints.
Which versions of Splunk Enterprise are affected by CVE-2026-20141?
Versions of Splunk Enterprise below 10.0.2, 10.0.3, 9.4.8, and 9.3.9 are affected by CVE-2026-20141.
What type of information can be disclosed due to CVE-2026-20141?
CVE-2026-20141 may lead to the disclosure of sensitive information through the Splunk Monitoring Console App.